OPENSUSE-SU-2026:22127-1: putty&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:22127-1 is a vulnerability in putty&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for putty This update for putty fixes the following issues: Changes in putty: - Update to release 0.85 * Fixed a remotely triggerable use-after-free in Pageant. * Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.) * Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.) * Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimited memory at startup. - Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short [boo#1266375, CVE-2026-48850] - Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature [boo#1266373, CVE-2026-48852] - Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing [boo#1266374, CVE-2026-48851]

No weakness data has been published for this record.