Multiple vulnerabilities have been discovered in PuTTY, the worst of which could lead to compromised keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | < 0.81 | >= 0.81 |
PuTTY is a free implementation of Telnet and SSH for Windows and Unix platforms, along with an xterm terminal emulator.
Multiple vulnerabilities have been discovered in PuTTY. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All PuTTY users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.81"
In addition, any keys generated with PuTTY versions 0.68 to 0.80 should be considered breached and should be regenerated.
A buffer overflow in PuTTY might allow remote attackers to execute arbitrary code or cause a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | < 0.68 | >= 0.68 |
PuTTY is a free implementation of Telnet and SSH for Windows and Unix platforms, along with an xterm terminal emulator.
A heap-corrupting buffer overflow bug in the ssh_agent_channel_data function of PuTTY was found.
A remote attacker, utilizing the SSH agent forwarding of an SSH server, could execute arbitrary code with the privileges of the user running the client or cause a Denial of Service condition.
There is no known workaround at this time.
All PuTTY users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.68"
Multiple vulnerabilities have been found in PuTTY, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | < 0.67 | >= 0.67 |
PuTTY is a telnet and SSH client.
Multiple vulnerabilities have been discovered in PuTTY. Please review the CVE identifiers referenced below for details.
Stack-based buffer overflow in the SCP command-line utility allows remote servers to execute arbitrary code or cause a denial of service condition via a crafted SCP-SINK file-size response to an SCP download request.
There is no known workaround at this time.
All PuTTY users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.67"
Multiple vulnerabilities have been found in Putty, allowing attackers to compromise user system
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | < 0.63 | >= 0.63 |
PuTTY is a telnet and SSH client.
Multiple vulnerabilities have been discovered in PuTTY. Please review the CVE identifiers referenced below for details.
An attacker could entice a user to open connection to specially crafted SSH server, possibly resulting in execution of arbitrary code with the privileges of the process or obtain sensitive information.
There is no known workaround at this time.
All PuTTY users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.63"
PuTTY was found to contain vulnerabilities that can allow a malicious SFTP server to execute arbitrary code on unsuspecting PSCP and PSFTP clients.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | < 0.57 | >= 0.57 |
PuTTY is a popular SSH client, PSCP is a secure copy implementation, and PSFTP is a SSH File Transfer Protocol client.
Two vulnerabilities have been discovered in the PSCP and PSFTP clients, which can be triggered by the SFTP server itself. These issues are caused by the improper handling of the FXP_READDIR response, along with other string fields.
An attacker can setup a malicious SFTP server that would send these malformed responses to a client, potentially allowing the execution of arbitrary code on their system.
There is no known workaround at this time.
All PuTTY users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.57"
PuTTY contains a vulnerability allowing an SSH server to execute arbitrary code on the connecting client.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | <= 0.55 | >= 0.56 |
PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator.
PuTTY fails to do proper bounds checking on SSH2_MSG_DEBUG packets. The "stringlen" parameter value is incorrectly checked due to signedness issues. Note that this vulnerability is similar to the one described in GLSA 200408-04 but not the same.
When PuTTY connects to a server using the SSH2 protocol, an attacker may be able to send specially crafted packets to the client, resulting in the execution of arbitrary code with the permissions of the user running PuTTY. Note that this is possible during the authentication process but before host key verification.
There is no known workaround at this time.
All PuTTY users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.56"
PuTTY contains a vulnerability allowing a SSH server to execute arbitrary code on the connecting client.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/putty | * | <= 0.54 | >= 0.55 |
PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator.
PuTTY contains a vulnerability allowing a malicious server to execute arbitrary code on the connecting client before host key verification.
When connecting to a server using the SSH2 protocol an attacker is able to execute arbitrary code with the permissions of the user running PuTTY by sending specially crafted packets to the client during the authentication process but before host key verification.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of PuTTY.
All PuTTY users should upgrade to the latest version:
# emerge sync # emerge -pv ">=net-misc/putty-0.55" # emerge ">=net-misc/putty-0.55"