On Mon, Aug 31, 2026 at 07:51:54PM +0100, Colin Watson wrote:
> On Sat, Aug 08, 2026 at 06:29:27PM +0200, Moritz Mühlenhoff wrote:
> > Source: openssh
> > X-Debbugs-CC: [email protected]
> > Severity: important
> > Tags: security
> >
> > Hi,
> >
> > The following vulnerability was published for openssh.
> >
> > CVE-2026-55655[0]:
> > | A flaw was found in OpenSSH. A local unprivileged attacker on a
> > | Linux client host can hijack client-side X11 forwarding connections.
> > | This is possible by pre-binding the preferred abstract X socket name
> > | when X11 forwarding is enabled and a local UNIX-domain X socket is
> > | used. A successful attack can compromise the confidentiality of
> > | forwarded X11 traffic, including sensitive window contents and
> > | input, and may allow some manipulation of the forwarded session.
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=2462250 is the only
> > reference and Red Hat released an update, but it's unclear whether
> > this is an issue in upstream OpenSSH or one of their patches.
>
> Red Hat fixed this in
> https://src.fedoraproject.org/rpms/openssh/c/fdea50ab12e005f274ff8e4aa6f1210730e866f8?branch=rawhide.
> I looked at this and it is fairly clearly an issue with one of their patches
> (which they've since dropped, in
> https://src.fedoraproject.org/rpms/openssh/c/f48279187d5eeefbfa05d6294afe753bb3d1c61d?branch=rawhide).
> Debian has never had a similar patch, so we're unaffected.
Thanks! I've updated the Debian security tracker.
Cheers,
Moritz
