The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssh | Openbsd | 3.7.1 (including) | 3.7.1 (including) |
| Openssh | Openbsd | 3.7.1p1 (including) | 3.7.1p1 (including) |