Bug 565080 – <net-misc/putty-0.66: integer overflow and buffer underrun in terminal emulator's ECH handling (CVE-2015-5309)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hanno Böck 2015-11-07 17:03:00 UTC]

From here:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html

"Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a potentially memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence in the terminal emulator."

0.66 is out and fixes this issue. Another sec issue was found but only in unreleased code:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ecdsa-newkey.html
(may be relevant for users of the -9999 ebuild, not sure)

[Comment 1 Jeroen Roovers (RETIRED) 2015-11-08 06:02:31 UTC]

Arch teams, please test and mark stable:
=net-misc/putty-0.66
Targeted stable KEYWORDS : alpha amd64 hppa ppc ppc64 sparc x86

[Comment 2 Jeroen Roovers (RETIRED) 2015-11-08 06:57:48 UTC]

Stable for PPC64.

[Comment 3 Jeroen Roovers (RETIRED) 2015-11-09 04:33:19 UTC]

Stable for HPPA.

[Comment 4 Agostino Sarubbo 2015-11-09 08:40:36 UTC]

amd64 stable

[Comment 5 Agostino Sarubbo 2015-11-09 08:41:02 UTC]

x86 stable

[Comment 6 Agostino Sarubbo 2015-11-12 10:25:57 UTC]

ppc stable

[Comment 7 Mikle Kolyada (RETIRED) 2015-12-25 20:00:30 UTC]

sparc stable

[Comment 8 Agostino Sarubbo 2016-01-10 10:41:59 UTC]

alpha stable.

Maintainer(s), please cleanup.

[Comment 9 Aaron Bauman (RETIRED) 2016-04-05 07:58:36 UTC]

Complete was completed.

Added to existing GLSA.

[Comment 10 Yury German 2016-06-05 17:24:17 UTC]

This issue was resolved and addressed in
 GLSA 201606-01 at https://security.gentoo.org/glsa/201606-01
by GLSA coordinator Yury German (BlueKnight)