CVE-2015-8325: Canonical Ubuntu Core

High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.

Affected products

• Canonical Ubuntu Core: version 15.04 only
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only
• Canonical Ubuntu Touch: version 15.04 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• OpenBSD OpenSSH: up to and including 7.2

Published 2016-05-01. Last modified 2026-06-17.