High
Security advisory
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-10009
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:03 UTC · Revision 1
Source evidence
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
osv:CVE-2016-10009
Complete source record
{
"id": "1cc6fcc9bf50f86819da9ad92acd4e3e8e8ced663bb09c098a4815569b186cee",
"url": "https://osv.dev/vulnerability/CVE-2016-10009",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-10009",
"summary": "Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.",
"evidence": "osv:CVE-2016-10009",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-10009",
"aliases": [
"CVE-2016-10009"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openbsd/src",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "9476ce1dd37d3c3218d5640b74c34c65e5f4efe5"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "9476ce1dd37d3c3218d5640b74c34c65e5f4efe5"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10009.json",
"vanir_signatures": [
{
"id": "CVE-2016-10009-6e1bf1ba",
"digest": {
"length": 5276,
"function_hash": "54322556810749533856674203680550405300"
},
"source": "https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5",
"target": {
"file": "usr.bin/ssh/ssh-agent.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10009-9aede9cd",
"digest": {
"length": 1620,
"function_hash": "184555741998832899293569114491144664366"
},
"source": "https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5",
"target": {
"file": "usr.bin/ssh/ssh-agent.c",
"function": "process_add_smartcard_key"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10009-a44430d9",
"digest": {
"length": 248,
"function_hash": "168430173209846986160139292021779653609"
},
"source": "https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5",
"target": {
"file": "usr.bin/ssh/ssh-agent.c",
"function": "usage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-10009-cbeaedac",
"digest": {
"threshold": 0.9,
"line_hashes": [
"142483365029668147691457446802921276205",
"250659224063928617215793942078706547538",
"186433263794914433655546570418640715506",
"145956066483205540825210961224514516665",
"205336514962396733962946238137086908057",
"308294402119300721808387440053904700120",
"229170636859438846261070092903996245548",
"133605912153722405171070541258834829263",
"298945563002082750975148888961149448936",
"18223243453012819806615890197908838889",
"92292952884314727365381090292952041489",
"250294875155092404905750109346889395714",
"303923036939542543422567147047301569345",
"165459416023956927317086797988258544570",
"194615421843460364635895814226128714084",
"14464617986697886313054505967818965353",
"123684310053238233503711894002495251236",
"207909760781518401665282819603546709059",
"78106355598291000459226506197302424160",
"106275913102308758012226899301898271087",
"242665360652111663045219209098025944356",
"139797183103614261312021618757273732659",
"182391827327216986141572706776590394273",
"111044574282543119978158872884833335479",
"288232552361581177306819966473921100645",
"297550672717688535026537946978165800386",
"107034572075901416288895530823586948123",
"100003948836048931810044988847738001910",
"106849634978805465190365600533325433236",
"101233567377053187735520598652020051794",
"335869512759701909861770044595716911071",
"328237990972000635419229533316714104257",
"259729757027794272826680827647026360446",
"85755012820083792425085775497825793503",
"124726711480376203878848898571313165213",
"98474810828369877792745208280358344886",
"98559506974840227351087186343261946048",
"167843081860392035951525998529388116105",
"268386579347951704159859878925413090012",
"51528988384784010480338758662223195005",
"169951084360471300534704882317258565364",
"321537092709250968834794765376342790241",
"300385835046007811152383045892687120525",
"320862203674190077317850581735226510658",
"51365043877139803052742965681721138317"
]
},
"source": "https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5",
"target": {
"file": "usr.bin/ssh/ssh-agent.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:04:08Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/openssh/openssh-portable",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "99522ba7ec6963a05c04a156bf20e3ba3605987c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "7.3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"V_7_3_P1",
"V_7_2_P1",
"V_7_1_P1",
"V_7_0_P1",
"V_6_9_P1",
"V_6_8_P1",
"V_6_6_P1",
"V_6_5_P1",
"V_6_2_P1",
"V_6_1_P1",
"V_6_0_P1",
"V_5_7_P1",
"V_5_5_P1",
"V_5_2_P1",
"V_5_1_P1",
"V_5_0_P1",
"V_4_2_P1",
"V_3_9_P1",
"V_3_8_P1",
"AFTER_KRB5_GSSAPI_MERGE",
"BEFORE_KRB5_GSSAPI_MERGE",
"POST_KRB4_REMOVAL",
"PRE_KRB4_REMOVAL",
"AFTER_FREEBSD_PAM_MERGE",
"BEFORE_FREEBSD_PAM_MERGE",
"V_3_6_1_P1",
"V_3_4_P1",
"V_3_2_2_P1",
"PRE_SW_KRBV",
"V_3_1_P1",
"V_3_0_1_P1",
"V_3_0_P1",
"V_2_5_2_P1",
"V_2_5_1_P2",
"V_2_5_1_P1",
"V_2_5_0_P1",
"PRE-REORDER",
"V_2_3_0_P1",
"PRE_CYGWIN_MERGE",
"V_2_2_0_P1",
"V_2_1_1_P4",
"V_2_1_1_P3",
"ABOUT_TO_ADD_INET_ATON",
"V_2_1_1_P2",
"V_2_1_1_P1",
"PRE_NEW_LOGIN_CODE",
"V_2_1_0_P3",
"V_2_1_0_P2",
"V_2_1_0_P1",
"V_2_1_0",
"V_2_0_0_BETA2",
"V_2_0_0_BETA1",
"V_2_0_0_TEST1",
"V_1_2_3_TEST3",
"V_1_2_3_TEST2",
"V_1_2_3_TEST1",
"V_1_2_3",
"V_1_2_3_PRE5",
"V_1_2_3_PRE4",
"V_1_2_3_PRE3",
"V_1_2_3_PRE2",
"V_1_2_3_PRE1",
"V_1_2_2_P1",
"V_1_2_2",
"V_1_2_2_PRE29",
"V_1_2_2_PRE28",
"V_1_2_1_PRE27",
"V_1_2_1_PRE26",
"PRE_IPV6",
"V_1_2_1_PRE25",
"V_1_2_1_PRE24",
"V_1_2_1_PRE23",
"V_1_2_1_PRE22",
"PRE_FIXPATHS_INTEGRATION",
"V_1_2_1_PRE21",
"V_1_2_1_PRE20",
"V_1_2_1_PRE19",
"PRE_HPUX_INTEGRATION",
"V_1_2_1_PRE18",
"V_1_2PRE17",
"V_1_2_PRE16",
"V_1_2_PRE15",
"V_1_2_PRE14",
"V_1_2_PRE13",
"V_1_2_PRE12",
"V_1_2_PRE11",
"V_1_2_PRE10",
"V_1_2_PRE9",
"V_1_2_PRE8",
"V_1_2_PRE7",
"V_1_2_PRE6",
"V_1_2_PRE5",
"V_1_2_PRE4",
"PRE_DAN_PATCH_MERGE"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10009.json"
}
}
],
"modified": "2026-10-24T14:04:08.776613553Z",
"provider": "osv",
"references": [
"https://bugs.chromium.org/p/project-zero/issues/detail?id=1009",
"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us",
"https://usn.ubuntu.com/3538-1/",
"https://www.exploit-db.com/exploits/40963/",
"https://www.openssh.com/txt/release-7.4",
"https://access.redhat.com/errata/RHSA-2017:2029",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc",
"https://security.netapp.com/advisory/ntap-20171130-0002/",
"https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-10009",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442904,
"published_at": "2017-01-05T02:59:03.057+00:00"
}