OpenSSH clients between versions 5.4 and 7.1 are vulnerable to information disclosure that may allow a malicious server to retrieve information including under some circumstances, user"s private keys. This may be mitigated by adding the undocumented config option UseRoaming no to ssh_config. This bug is corrected in OpenSSH 7.1p2 and in OpenBSD"s stable branch. CVE-2016-0777. An information leak can be exploited by a rogue SSH server to trick a client into leaking sensitive data from the client memory, including for example private keys. CVE-2016-0778. A buffer overflow , can also be exploited by a rogue SSH server, but due to another bug in the code is possibly not exploitable, and only under certain conditions , when using ProxyCommand, ForwardAgent or ForwardX11.