Debian Security Advisory
DSA-3190-1 putty -- security update
- Date Reported:
- 15 Mar 2015
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2015-2157.
- More information:
Patrick Coleman discovered that the Putty SSH client failed to wipe out unused sensitive memory.
In addition Florent Daigniere discovered that exponential values in Diffie Hellman exchanges were insufficienty restricted.
For the stable distribution (wheezy), this problem has been fixed in version 0.62-9+deb7u2.
For the upcoming stable distribution (jessie), this problem has been fixed in version 0.63-10.
For the unstable distribution (sid), this problem has been fixed in version 0.63-10.
We recommend that you upgrade your putty packages.