FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  371856
Date:      2014-10-31
Time:      15:38:00Z
Committer: rea

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
19518d22-2d05-11d9-8943-0050fc56d258putty -- buffer overflow vulnerability in ssh2 support

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to.


Discovery 2004-10-26
Entry 2004-11-04
Modified 2005-01-19
putty
lt 0.56

http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207
http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html
4b448a96-ff73-11e2-b28d-080027ef73ecPuTTY -- Four security holes in versions before 0.63

Simon Tatham reports:

This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]

These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.

Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.


Discovery 2013-07-08
Entry 2013-08-07
putty
lt 0.63

CVE-2013-4206
CVE-2013-4207
CVE-2013-4208
CVE-2013-4852
http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html
a413ed94-836e-11d9-a9e7-0001020eed82putty -- pscp/psftp heap corruption vulnerabilities

Simon Tatham reports:

This version fixes a security hole in previous versions of PuTTY, which can allow a malicious SFTP server to attack your client. If you use either PSCP or PSFTP, you should upgrade. Users of the main PuTTY program are not affected. (However, note that the server must have passed host key verification before this attack can be launched, so a man-in-the-middle shouldn't be able to attack you if you're careful.)


Discovery 2005-02-20
Entry 2005-02-20
Modified 2005-02-23
putty
lt 0.57

12601
CVE-2005-0467
http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html
http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
19518d22-2d05-11d9-8943-0050fc56d258putty -- buffer overflow vulnerability in ssh2 support

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to.


Discovery 2004-10-26
Entry 2004-11-04
Modified 2005-01-19
putty
lt 0.56

http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207
http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html
a413ed94-836e-11d9-a9e7-0001020eed82putty -- pscp/psftp heap corruption vulnerabilities

Simon Tatham reports:

This version fixes a security hole in previous versions of PuTTY, which can allow a malicious SFTP server to attack your client. If you use either PSCP or PSFTP, you should upgrade. Users of the main PuTTY program are not affected. (However, note that the server must have passed host key verification before this attack can be launched, so a man-in-the-middle shouldn't be able to attack you if you're careful.)


Discovery 2005-02-20
Entry 2005-02-20
Modified 2005-02-23
putty
lt 0.57

12601
CVE-2005-0467
http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html
http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html