CVE-2016-1235

high

Published 2016-04-11 · Modified 2026-05-06

CVSS v3

8.8

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2

9.0

VIR risk

8.8

Description

The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options.

Predictions

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-1235

vendor Authored 2026-05-27

Vendor advisory: security@debian.org — http://oar.imag.fr/oar_2.5.7

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`2.5.7-1`
debian	bullseye	fixed	`2.5.7-1`
debian	forky	fixed	`2.5.7-1`
debian	sid	fixed	`2.5.7-1`
debian	trixie	fixed	`2.5.7-1`
debian	8.0	affected

Application impact

Vendor	Product	Versions	Fixed
oar_project	oar	`{"endIncluding":"2.5.6"}`

References

http://oar.imag.fr/oar_2.5.7
http://www.debian.org/security/2016/dsa-3543
https://raw.githubusercontent.com/oar-team/oar/ce77ffed620fdce94881c9b35064507777c24a1c/debian/patches/004-fix-oarsh-security-issue
https://security-tracker.debian.org/tracker/CVE-2016-1235

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.