CVE-2016-10010

Name	CVE-2016-10010
Description	sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: local)
Debian Bugs	848715

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openssh (PTS)	jessie	1:6.7p1-5+deb8u4	vulnerable
	jessie (security)	1:6.7p1-5+deb8u8	vulnerable
	stretch (security), stretch	1:7.4p1-10+deb9u6	fixed
	buster	1:7.9p1-10	fixed
	bullseye, sid	1:8.0p1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
openssh	source	(unstable)	1:7.4p1-1	unimportant		848715

Notes

Fixed in upstream 7.4: https://www.openssh.com/txt/release-7.4
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/serverloop.c.diff?r1=1.188&r2=1.189
Privilege separation is enabled in the Debian package