Security Information / 2015 / Security Information -- DSA-3190-1 putty

Debian Security Advisory

DSA-3190-1 putty -- security update

Date Reported:

15 Mar 2015

Affected Packages:

putty

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2015-2157.

More information:

Patrick Coleman discovered that the Putty SSH client failed to wipe out unused sensitive memory.

In addition Florent Daigniere discovered that exponential values in Diffie Hellman exchanges were insufficienty restricted.

For the stable distribution (wheezy), this problem has been fixed in version 0.62-9+deb7u2.

For the upcoming stable distribution (jessie), this problem has been fixed in version 0.63-10.

For the unstable distribution (sid), this problem has been fixed in version 0.63-10.

We recommend that you upgrade your putty packages.