PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-6387] RCE vulnerability in OpenSSH: everything you need to know

wiz.io | vulnerability | CVE-2024-6387 | #rce | #linux | #vulnerability | #patching | #openssh | #cve-2024-6387
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2024-6387 (regreSSHion) is an unauthenticated root RCE in OpenSSH's server—a signal handler race on glibc-based Linux; mass exploitation is deemed unlikely, but prompt patching is advised.
CVE
CVE-2024-6387
Published
Collected

Related coverage

vulnerability · netspi.com
Impact Analysis: regreSSHion OpenSSH Vulnerability (CVE-2024-6387)
regreSSHion (CVE-2024-6387) is an unauthenticated RCE in OpenSSH sshd on glibc-based Linux, reviving a 2006 flaw. Mass exploitation is unlikely, but prompt patching and monitoring remain essential.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back