Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Jan 2016 20:32:49 +0100
From: Tomas Hoger <>
Subject: Re: Re: Qualys Security Advisory - Roaming through
 the OpenSSH client: CVE-2016-0777 and CVE-2016-0778

On Fri, 15 Jan 2016 12:10:16 -0500 (EST) wrote:

> > There's also a fix related to X11 forwarding which seems different than
> > the fix which went into OpenSSH 6.9. I'm not sure if it deserves a CVE
> > or not.  
> >  
> >> eliminate fallback from untrusted X11 forwarding to trusted forwarding
> >> when the X server disables the SECURITY extension; Reported by Thomas
> >> Hoger  
> MITRE is not assigning a CVE ID for
> ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c at this time. First, the
> (misspelled) reporter name suggests that the issue might have already
> had a CVE ID assigned by Red Hat before the issue became public. Also,
> does not announce this as a
> security fix. Finally, the wording suggests that it could possibly be
> an interoperability fix, not a security fix.

FYI, this issue was announced as a security fix in 7.1p2 release notes:

However, as the fix was not actually included in 7.1p2, the
release-7.1p2 announcement as available on the url listed above was
modified to remove mention of that issue.

Tomas Hoger / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.