BSD Portsputty -- multiple security vulnerabilities
Simon Tatham reports: These features are new in PuTTY 0.84: Security issue: fixed a remotely triggerable double-free in RSA key exchange. (We don't know of any way it is exploitable to execute code.) Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. (An assertion failure – definitely not exploitable to execute code.) Minor security issue: fixed marking of Telnet and …
Affected versions
- putty < 0.84
- putty-nogtk < 0.84
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/putty | 0.83 | vulnerable since 2026-05-22 | |
| OpenBSD | net/putty | 0.85 | out of range, by version | |
| NetBSD | security/putty | 0.85nb2 | not listed | |
| FreeBSD | security/putty | 0.85 | fixed | (86 days after) |
| DragonFly | security/putty-nogtk | 0.83 | vulnerable since 2026-05-22 | |
| FreeBSD | security/putty-nogtk | 0.85 | fixed |