openSUSE-SU-2026:22127-1

openSUSE-SU-2026:22127-1 · Security update for putty

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for putty fixes the following issues: Changes in putty: - Update to release 0.85 * Fixed a remotely triggerable use-after-free in Pageant. * Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.) * Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.) * Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimited memory at startup. - Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short [boo#1266375, CVE-2026-48850] - Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature [boo#1266373, CVE-2026-48852] - Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing [boo#1266374, CVE-2026-48851]

Fix available

Published

2026-10-19T16:05:00Z

Updated

2026-10-20T19:15:04.882448721Z

Stack: system

Check your server →