From: Yury German Reply-To: blueknight@gentoo.org To: gentoo-announce@lists.gentoo.org Message-ID: <636b0e86-be3d-e1ab-8af0-c88045a44fff@gentoo.org> Subject: [ GLSA 201606-01 ] PuTTY: Multiple vulnerabilities - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201606-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PuTTY: Multiple vulnerabilities Date: June 05, 2016 Bugs: #565080, #576524 ID: 201606-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in PuTTY, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition. Background ========== PuTTY is a telnet and SSH client. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/putty < 0.67 >= 0.67 Description =========== Multiple vulnerabilities have been discovered in PuTTY. Please review the CVE identifiers referenced below for details. Impact ====== Stack-based buffer overflow in the SCP command-line utility allows remote servers to execute arbitrary code or cause a denial of service condition via a crafted SCP-SINK file-size response to an SCP download request. Workaround ========== There is no known workaround at this time. Resolution ========== All PuTTY users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/putty-0.67" References ========== [ 1 ] CVE-2015-5309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5309 [ 2 ] CVE-2016-2563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2563 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201606-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --MApC97kdRhNjSKH0kG4H37TQQNuVKXfhC