CVE-2015-5309
NONE EPSS 87.6%
Published Dec 7, 201510y ago · Modified Jun 17, 20262w ago
Published Dec 7, 2015 10y ago
Last Modified Jun 17, 2026 2w ago
Description
Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer underflow.
Threat Intelligence
EPSS Exploit Probability
87.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-189
Affected Products 4
| Vendor | Product | Version | Range |
|---|---|---|---|
| opensuse | leap | 42.1 | any |
| opensuse | opensuse | 13.1 | any |
| opensuse | opensuse | 13.2 | any |
| simon_tatham | putty | * | ≤0.65 |
References 7
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173021.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173094.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-11/msg00099.html
- chiark.greenend.org.uk http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html
- debian.org http://www.debian.org/security/2015/dsa-3409
- securitytracker.com http://www.securitytracker.com/id/1034308
- security.gentoo.org https://security.gentoo.org/glsa/201606-01
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.