Debian/dropbear: high 8.8
The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.
Action: Upgrade dropbear to 2016.74-5 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2016.74-5 | - |
Fixed versions
| 2016.74-5 |
Sources
- osv: DEBIAN-CVE-2017-9078#Debian:13/dropbear
- https://security-tracker.debian.org/tracker/CVE-2017-9078
published · modified · JSON