Lucene search

K
mageiaGentoo FoundationMGASA-2015-0098
HistoryMar 06, 2015 - 9:08 p.m.

Updated putty and filezilla packages fix CVE-2015-2157

2015-03-0621:08:57
Gentoo Foundation
advisories.mageia.org
13

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

Updated putty and filezilla packages fix security vulnerability: PuTTY suite versions 0.51 to 0.63 fail to clear SSH-2 private key information from memory when loading and saving key files to disk, leading to potential disclosure. The issue affects keys stored on disk in encrypted and unencrypted form, and is present in PuTTY, Plink, PSCP, PSFTP, Pageant and PuTTYgen (CVE-2015-2157). The putty package has been updated to version 0.64, fixing this and other issues. The filezilla package, which contains a bundled version of PuTTY, has also been updated, to version 3.10.2.

OSVersionArchitecturePackageVersionFilename
Mageia4noarchputty< 0.64-1putty-0.64-1.mga4
Mageia4noarchfilezilla< 3.10.2-1filezilla-3.10.2-1.mga4

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%