Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 6: MGASA-2019-0153 moderate: PuTTY Buffer Overflow Issues

mageia
Calendar Grey May 7, 2019
Dist Mageia Esm H88
Enhanced versions of FileZilla, PuTTY, and wxGTK address significant security vulnerabilities in Mageia 6.
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification (CVE-2019-9894)

Summary

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification (CVE-2019-9894).
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding (CVE-2019-9895).
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71 (CVE-2019-9897).
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71 (CVE-2019-9898).
The putty package has been updated to version 0.71 and the filezilla package has been updated and patched to fix these issues.
wxgtk has been updated to fix an assert when starting filezilla.

References

- https://bugs.mageia.org/show_bug.cgi?id=24547

- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LDO3F267P347E6U2IILFCYW7JPTLCCES/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TBPZ6RAMBOJAKKPJ54MPIPJTXNB2T6FW/

- https://wxwidgets.org/develop/how-to-report-issues/trac-migration/

- https://www.cve.org/CVERecord?id=CVE-2019-9894

- https://www.cve.org/CVERecord?id=CVE-2019-9895

- https://www.cve.org/CVERecord?id=CVE-2019-9897

- https://www.cve.org/CVERecord?id=CVE-2019-9898

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow file transfer memory overwrite Mageia

Resolution

SRPMS

- 6/core/putty-0.71-1.mga6

- 6/core/filezilla-3.31.0-1.mga6

- 6/core/libfilezilla-0.12.1-1.mga6

- 6/core/wxgtk-3.0.3.1-1.1.mga6

Publication date: 07 May 2019
URL: https://advisories.mageia.org/MGASA-2019-0153.html
Type: security
CVE: CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow file transfer memory overwrite Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here