The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.
| Software | From | Fixed in |
|---|---|---|
| openbsd / openssh | 3.7.1p1 | 3.7.1p1.x |
| openbsd / openssh | 3.7.1 | 3.7.1.x |