CVE-2016-10708: Null Pointer Dereference
Last updated 25 August 2025
Other sources
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-10708?
CVE-2016-10708 is a vulnerability in OpenSSH that allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message.
What is the severity of CVE-2016-10708?
The severity of CVE-2016-10708 is high with a severity value of 7.5.
How can I fix CVE-2016-10708?
To fix CVE-2016-10708, update OpenSSH to version 7.9p1-10+deb10u2, 7.9p1-10+deb10u3, 8.4p1-5+deb11u2, 9.2p1-2+deb12u1, or 9.4p1-1.
Is OpenSSH version 6.6 vulnerable to CVE-2016-10708?
Yes, OpenSSH version 6.6 is vulnerable to CVE-2016-10708.
Where can I find more information about CVE-2016-10708?
You can find more information about CVE-2016-10708 at the following references: http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html, http://www.securityfocus.com/bid/102780, https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737.