Servers and applications
CVE-2008-3259 OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.
Severity Low 1.2
Published 22 Jul 2008
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 0.3% in the next 30 daysHigher than 26% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Needs local access · Only under certain conditions · No login needed
Attacker can Read some data
CVSS vector AV:L/AC:H/Au:N/C:P/I:N/A:N
Sources NVD Affected software Software Affected versions OpenSSHServers and applications · cpe:a:openbsd:openssh Version 4.9 Version 4.8 Version 4.7 Version 4.6 All 71 release lines Every version up to 5.0 Version 1.2 Version 1.2.1 Version 1.2.2 Version 1.2.3 Version 1.2.27 Version 1.3 Version 1.5 Version 1.5.7 Version 1.5.8 Version 2.1 Version 2.1.1 Version 2.2 Version 2.3 Version 2.3.1 Version 2.5 Version 2.5.1 Version 2.5.2 Version 2.9 Version 2.9p1 Version 2.9p2 Version 2.9.9 Version 2.9.9p2 Version 3.0 Version 3.0p1 Version 3.0.1 Version 3.0.1p1 Version 3.0.2 Version 3.0.2p1 Version 3.1 Version 3.1p1 Version 3.2 Version 3.2.2 Version 3.2.2p1 Version 3.2.3p1 Version 3.3 Version 3.3p1 Version 3.4 Version 3.4p1 Version 3.5 Version 3.5p1 Version 3.6 Version 3.6.1 Version 3.6.1p1 Version 3.6.1p2 Version 3.7 Version 3.7.1 Version 3.7.1p1 Version 3.7.1p2 Version 3.8 Version 3.8.1 Version 3.8.1p1 Version 3.9 Version 3.9.1 Version 3.9.1p1 Version 4.0 Version 4.0p1 Version 4.1 Version 4.1p1 Version 4.2 Version 4.2p1 Version 4.3 Version 4.3p1 Version 4.3p2 Version 4.4 Version 4.4p1 Version 4.5 Version 4.6 Version 4.7 Version 4.8 Version 4.9
References NVD https://nvd.nist.gov/vuln/detail/CVE-2008-3259 CVE.org https://www.cve.org/CVERecord?id=CVE-2008-3259