[ GLSA 201606-01 ] PuTTY

[GLSA]

Gentoo Linux Security Advisory

Title: PuTTY: Multiple vulnerabilities (GLSA 201606-01)
Severity: normal
Exploitable: remote
Date: June 05, 2016
Bug(s): #565080, #576524
ID: 201606-01

Synopsis

Multiple vulnerabilities have been found in PuTTY, the worst of
which could lead to arbitrary code execution, or cause a Denial of Service
condition.


Background

PuTTY is a telnet and SSH client.

Affected Packages

Package: net-misc/putty
Vulnerable: < 0.67
Unaffected: >= 0.67
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in PuTTY. Please review
the CVE identifiers referenced below for details.


Impact

Stack-based buffer overflow in the SCP command-line utility allows
remote servers to execute arbitrary code or cause a denial of service
condition via a crafted SCP-SINK file-size response to an SCP download
request.


Workaround

There is no known workaround at this time.

Resolution

All PuTTY users should upgrade to the latest version: