aports issueshttps://gitlab.alpinelinux.org/alpine/aports/-/issues2019-07-23T11:11:47Zhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10256[3.6] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)2019-07-23T11:11:47ZAlicha CH[3.6] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### Referen...Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### References:
http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
https://security-tracker.debian.org/tracker/CVE-2019-6706
*(from redmine: issue id 10256, created on 2019-04-15, closed on 2019-05-06)*
* Relations:
* parent #10251
* Changesets:
* Revision 01caeea43bd4470bd3d48c51abf2cbc53654f774 by Natanael Copa on 2019-05-06T17:21:50Z:
```
main/lua5.3: security fix for CVE-2019-6706
fixes #10256
(cherry picked from commit ebd55722b9637f4559c94b13e5e061ffef9fb4a3)
```3.6.6Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10255[3.7] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)2019-07-23T11:11:49ZAlicha CH[3.7] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### Referen...Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### References:
http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
https://security-tracker.debian.org/tracker/CVE-2019-6706
*(from redmine: issue id 10255, created on 2019-04-15, closed on 2019-05-06)*
* Relations:
* parent #10251
* Changesets:
* Revision fda894f6c300cc264f5ca3fb93f499fe51a15750 by Natanael Copa on 2019-05-06T17:13:58Z:
```
main/lua5.3: upgrade to 5.3.5 and sec fix CVE-2019-6706
fixes #10255
```3.7.4Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10254[3.8] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)2019-07-23T11:11:49ZAlicha CH[3.8] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### Referen...Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### References:
http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
https://security-tracker.debian.org/tracker/CVE-2019-6706
*(from redmine: issue id 10254, created on 2019-04-15, closed on 2019-05-06)*
* Relations:
* parent #10251
* Changesets:
* Revision 7ad58d2fec12ba6086e2774460d4bfe9e91471a9 by Natanael Copa on 2019-05-06T17:08:39Z:
```
main/lua5.3: security fix for CVE-2019-6706
fixes #10254
(cherry picked from commit ebd55722b9637f4559c94b13e5e061ffef9fb4a3)
```3.8.5Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10253[3.9] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)2019-07-23T11:11:51ZAlicha CH[3.9] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### Referen...Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### References:
http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
https://security-tracker.debian.org/tracker/CVE-2019-6706
*(from redmine: issue id 10253, created on 2019-04-15, closed on 2019-05-06)*
* Relations:
* parent #10251
* Changesets:
* Revision ebd55722b9637f4559c94b13e5e061ffef9fb4a3 by Natanael Copa on 2019-05-06T17:07:51Z:
```
main/lua5.3: security fix for CVE-2019-6706
fixes #10253
```3.9.4Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10252[3.10] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)2019-07-23T11:11:52ZAlicha CH[3.10] lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### Referen...Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### References:
http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
https://security-tracker.debian.org/tracker/CVE-2019-6706
*(from redmine: issue id 10252, created on 2019-04-15, closed on 2019-05-06)*
* Relations:
* parent #10251
* Changesets:
* Revision 7571f6ce08088d0644c95da6b1c4a780078951a8 by Natanael Copa on 2019-05-06T17:03:40Z:
```
main/lua5.3: security fix for CVE-2019-6706
fixes #10252
```3.10.0Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10251lua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)2019-07-23T11:11:53ZAlicha CHlua5.3: use-after-free in lua_upvaluejoin in lapi.c (CVE-2019-6706)Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### Referen...Lua 5.3.5 has a use-after-free in lua\_upvaluejoin in lapi.c. For
example, a crash outcome might be achieved by an
attacker who is able to trigger a debug.upvaluejoin call in which the
arguments have certain relationships.
### References:
http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
https://security-tracker.debian.org/tracker/CVE-2019-6706
*(from redmine: issue id 10251, created on 2019-04-15, closed on 2019-05-06)*
* Relations:
* child #10252
* child #10253
* child #10254
* child #10255
* child #10256
* child #10264Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10250[3.6] samba: Save registry file outside share as unprivileged user (CVE-2019-...2019-07-23T11:11:54ZAlicha CH[3.6] samba: Save registry file outside share as unprivileged user (CVE-2019-3880)Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hiv...Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hive file anywhere they have unix permissions to
create a new file within a Samba share. If they are able to create
symlinks on a Samba share, they can create a new registry hive file
anywhere they have write access, even outside a Samba share
definition.
### Affected Versions:
All versions of samba since samba 3.2.0
### Fixed In Version:
samba 4.8.11, 4.9.6 and 4.10.2
### References:
https://www.samba.org/samba/security/CVE-2019-3880.html
https://www.samba.org/samba/history/security.html
### Patch:
https://download.samba.org/pub/samba/patches/security/samba-4.8.10-security-2019-04-08.patch
*(from redmine: issue id 10250, created on 2019-04-15, closed on 2019-04-18)*
* Relations:
* parent #10246
* Changesets:
* Revision 95d4fe44472f363becdee360ad5713584a061db8 on 2019-04-17T09:19:32Z:
```
main/samba: security fix (CVE-2019-3880)
Fixes #10250
Signed-off-by: Leonardo Arena <rnalrd@alpinelinux.org>
```3.6.6Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10249[3.7] samba: Save registry file outside share as unprivileged user (CVE-2019-...2019-07-23T11:11:54ZAlicha CH[3.7] samba: Save registry file outside share as unprivileged user (CVE-2019-3880)Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hiv...Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hive file anywhere they have unix permissions to
create a new file within a Samba share. If they are able to create
symlinks on a Samba share, they can create a new registry hive file
anywhere they have write access, even outside a Samba share
definition.
### Affected Versions:
All versions of samba since samba 3.2.0
### Fixed In Version:
samba 4.8.11, 4.9.6 and 4.10.2
### References:
https://www.samba.org/samba/security/CVE-2019-3880.html
https://www.samba.org/samba/history/security.html
### Patch:
https://download.samba.org/pub/samba/patches/security/samba-4.8.10-security-2019-04-08.patch
*(from redmine: issue id 10249, created on 2019-04-15, closed on 2019-04-18)*
* Relations:
* parent #10246
* Changesets:
* Revision dd592906931a0d72d098e6385832a370bbb221c2 on 2019-04-17T08:33:43Z:
```
main/samba: security fix (CVE-2019-3880)
Fixes #10249
Signed-off-by: Leonardo Arena <rnalrd@alpinelinux.org>
```3.7.4Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10248[3.8] samba: Save registry file outside share as unprivileged user (CVE-2019-...2019-07-23T11:11:55ZAlicha CH[3.8] samba: Save registry file outside share as unprivileged user (CVE-2019-3880)Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hiv...Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hive file anywhere they have unix permissions to
create a new file within a Samba share. If they are able to create
symlinks on a Samba share, they can create a new registry hive file
anywhere they have write access, even outside a Samba share
definition.
### Affected Versions:
All versions of samba since samba 3.2.0
### Fixed In Version:
samba 4.8.11, 4.9.6 and 4.10.2
### References:
https://www.samba.org/samba/security/CVE-2019-3880.html
https://www.samba.org/samba/history/security.html
### Patch:
https://download.samba.org/pub/samba/patches/security/samba-4.8.10-security-2019-04-08.patch
*(from redmine: issue id 10248, created on 2019-04-15, closed on 2019-04-18)*
* Relations:
* parent #102463.8.5Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10247[3.9] samba: Save registry file outside share as unprivileged user (CVE-2019-...2019-07-23T11:11:56ZAlicha CH[3.9] samba: Save registry file outside share as unprivileged user (CVE-2019-3880)Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hiv...Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hive file anywhere they have unix permissions to
create a new file within a Samba share. If they are able to create
symlinks on a Samba share, they can create a new registry hive file
anywhere they have write access, even outside a Samba share
definition.
### Affected Versions:
All versions of samba since samba 3.2.0
### Fixed In Version:
samba 4.8.11, 4.9.6 and 4.10.2
### References:
https://www.samba.org/samba/security/CVE-2019-3880.html
https://www.samba.org/samba/history/security.html
### Patch:
https://download.samba.org/pub/samba/patches/security/samba-4.8.10-security-2019-04-08.patch
*(from redmine: issue id 10247, created on 2019-04-15, closed on 2019-04-18)*
* Relations:
* parent #10246
* Changesets:
* Revision 46d7859df86413549905a72f31b1f89c45fb34aa on 2019-04-15T13:07:20Z:
```
main/samba: security upgrade to 4.8.11
CVE-2018-14629, CVE-2019-3880
Fixes #10247
Signed-off-by: Leonardo Arena <rnalrd@alpinelinux.org>
```
* Revision 186547c42b833832f85ac23b0d11eef6805258fc on 2019-04-15T14:45:19Z:
```
main/samba: security upgrade to 4.8.11
CVE-2018-14629, CVE-2019-3880
Fixes #10247
Signed-off-by: Leonardo Arena <rnalrd@alpinelinux.org>
```3.9.4Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10246samba: Save registry file outside share as unprivileged user (CVE-2019-3880)2019-07-23T11:11:58ZAlicha CHsamba: Save registry file outside share as unprivileged user (CVE-2019-3880)Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hiv...Samba contains an RPC endpoint emulating the Windows registry service
API. One of the requests, “winreg\_SaveKey”, is susceptible to a
path/symlink traversal vulnerability. Unprivileged users can use it to
create a new registry hive file anywhere they have unix permissions to
create a new file within a Samba share. If they are able to create
symlinks on a Samba share, they can create a new registry hive file
anywhere they have write access, even outside a Samba share
definition.
### Affected Versions:
All versions of samba since samba 3.2.0
### Fixed In Version:
samba 4.8.11, 4.9.6 and 4.10.2
### References:
https://www.samba.org/samba/security/CVE-2019-3880.html
https://www.samba.org/samba/history/security.html
### Patch:
https://download.samba.org/pub/samba/patches/security/samba-4.8.10-security-2019-04-08.patch
*(from redmine: issue id 10246, created on 2019-04-15, closed on 2019-04-18)*
* Relations:
* child #10247
* child #10248
* child #10249
* child #10250Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10214[3.6] wget: Buffer overflow vulnerability (CVE-2019-5953)2019-07-23T11:12:11ZAlicha CH[3.6] wget: Buffer overflow vulnerability (CVE-2019-5953)A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/...A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/en/jp/JVN25261088/
### Patch:
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=562eacb76a2b64d5dc80a443f0f739bc9ef76c17
(cosmetic, removes debug lines)
*(from redmine: issue id 10214, created on 2019-04-08, closed on 2019-04-15)*
* Relations:
* parent #10210
* Changesets:
* Revision 4fe04b973fbbc21f35cf3ca46fff4bbbee15ca96 on 2019-04-08T11:47:25Z:
```
main/wget: security upgrade to 1.20.3 (CVE-2019-5953)
Fixes #10214
```3.6.6Carlo LandmeterCarlo Landmeterhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10213[3.7] wget: Buffer overflow vulnerability (CVE-2019-5953)2019-07-23T11:12:13ZAlicha CH[3.7] wget: Buffer overflow vulnerability (CVE-2019-5953)A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/...A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/en/jp/JVN25261088/
### Patch:
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=562eacb76a2b64d5dc80a443f0f739bc9ef76c17
(cosmetic, removes debug lines)
*(from redmine: issue id 10213, created on 2019-04-08, closed on 2019-04-15)*
* Relations:
* parent #10210
* Changesets:
* Revision bc0c71befeb178f24f4348fe7f0482a969b89b82 on 2019-04-08T11:45:59Z:
```
main/wget: security upgrade to 1.20.3 (CVE-2019-5953)
Fixes #10213
```3.7.4Carlo LandmeterCarlo Landmeterhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10212[3.8] wget: Buffer overflow vulnerability (CVE-2019-5953)2019-07-23T11:12:14ZAlicha CH[3.8] wget: Buffer overflow vulnerability (CVE-2019-5953)A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/...A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/en/jp/JVN25261088/
### Patch:
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=562eacb76a2b64d5dc80a443f0f739bc9ef76c17
(cosmetic, removes debug lines)
*(from redmine: issue id 10212, created on 2019-04-08, closed on 2019-04-15)*
* Relations:
* parent #10210
* Changesets:
* Revision e307d117a71c3d0d1da9d4f86f8723ed4cce91f7 on 2019-04-08T11:44:49Z:
```
main/wget: security upgrade to 1.20.3 (CVE-2019-5953)
Fixes #10212
```3.8.5Carlo LandmeterCarlo Landmeterhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10211[3.9] wget: Buffer overflow vulnerability (CVE-2019-5953)2019-07-23T11:12:15ZAlicha CH[3.9] wget: Buffer overflow vulnerability (CVE-2019-5953)A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/...A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/en/jp/JVN25261088/
### Patch:
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=562eacb76a2b64d5dc80a443f0f739bc9ef76c17
(cosmetic, removes debug lines)
*(from redmine: issue id 10211, created on 2019-04-08, closed on 2019-04-15)*
* Relations:
* parent #10210
* Changesets:
* Revision c2ba5a1156a3f4249ccfee03ae2de7e1e7f8e5a6 on 2019-04-08T10:09:31Z:
```
main/wget: security upgrade to 1.20.3 (CVE-2019-5953)
Fixes #10211
```3.9.3Carlo LandmeterCarlo Landmeterhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10210wget: Buffer overflow vulnerability (CVE-2019-5953)2019-07-23T11:12:16ZAlicha CHwget: Buffer overflow vulnerability (CVE-2019-5953)A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/...A buffer overflow vulnerability was found in GNU Wget 1.20.1 and
earlier. An attacker may be able
to cause a denial-of-service (DoS) or may execute an arbitrary code.
### Fixed In Version:
wget 1.20.3
### Reference:
https://jvn.jp/en/jp/JVN25261088/
### Patch:
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=562eacb76a2b64d5dc80a443f0f739bc9ef76c17
(cosmetic, removes debug lines)
*(from redmine: issue id 10210, created on 2019-04-08, closed on 2019-04-15)*
* Relations:
* child #10211
* child #10212
* child #10213
* child #10214Carlo LandmeterCarlo Landmeterhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10197[3.6] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019...2019-07-23T11:12:22ZAlicha CH[3.6] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898)**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtath...**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9894
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=d82854999516046122501b2e145099740ed0284f
**CVE-2019-9895**: In PuTTY versions before 0.71 on Unix, a remotely
triggerable
buffer overflow exists in any kind of server-to-client forwarding.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9895
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=5c926d9ea4a9e0a0a2384f06c7583648cdff3ed6
**CVE-2019-9897**: Multiple denial-of-service attacks that can be
triggered by writing
to the terminal exist in PuTTY versions before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://security-tracker.debian.org/tracker/CVE-2019-9897
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=da1c8f15b1bc14c855f0027cf06ba7f1a9c36f3c
**CVE-2019-9898**: Potential recycling of random numbers used in
cryptography exists within PuTTY before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=320bf8479ff5bcbad239db4f9f4aa63656b0675e
*(from redmine: issue id 10197, created on 2019-04-04, closed on 2019-04-15)*
* Relations:
* parent #10192
* Changesets:
* Revision 5ff69c33184958f7cc0a18b0a80c819d82e9a49e on 2019-04-08T12:40:10Z:
```
main/putty: security upgrade to 0.71
CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898
Fixes #10197
Update license, disable check
```3.6.6Jeff Bilykjbilyk@gmail.comJeff Bilykjbilyk@gmail.comhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10196[3.7] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019...2019-07-23T11:12:23ZAlicha CH[3.7] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898)**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtath...**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9894
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=d82854999516046122501b2e145099740ed0284f
**CVE-2019-9895**: In PuTTY versions before 0.71 on Unix, a remotely
triggerable
buffer overflow exists in any kind of server-to-client forwarding.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9895
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=5c926d9ea4a9e0a0a2384f06c7583648cdff3ed6
**CVE-2019-9897**: Multiple denial-of-service attacks that can be
triggered by writing
to the terminal exist in PuTTY versions before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://security-tracker.debian.org/tracker/CVE-2019-9897
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=da1c8f15b1bc14c855f0027cf06ba7f1a9c36f3c
**CVE-2019-9898**: Potential recycling of random numbers used in
cryptography exists within PuTTY before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=320bf8479ff5bcbad239db4f9f4aa63656b0675e
*(from redmine: issue id 10196, created on 2019-04-04, closed on 2019-04-15)*
* Relations:
* parent #10192
* Changesets:
* Revision 97a56710a5b55f5f51f6c541b3b99084fa0d934b on 2019-04-08T12:28:10Z:
```
main/putty: security upgrade to 0.71
CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898
Fixes #10196
Update license, disable check
```3.7.4Jeff Bilykjbilyk@gmail.comJeff Bilykjbilyk@gmail.comhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10195[3.8] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019...2019-07-23T11:12:25ZAlicha CH[3.8] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898)**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtath...**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9894
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=d82854999516046122501b2e145099740ed0284f
**CVE-2019-9895**: In PuTTY versions before 0.71 on Unix, a remotely
triggerable
buffer overflow exists in any kind of server-to-client forwarding.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9895
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=5c926d9ea4a9e0a0a2384f06c7583648cdff3ed6
**CVE-2019-9897**: Multiple denial-of-service attacks that can be
triggered by writing
to the terminal exist in PuTTY versions before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://security-tracker.debian.org/tracker/CVE-2019-9897
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=da1c8f15b1bc14c855f0027cf06ba7f1a9c36f3c
**CVE-2019-9898**: Potential recycling of random numbers used in
cryptography exists within PuTTY before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=320bf8479ff5bcbad239db4f9f4aa63656b0675e
*(from redmine: issue id 10195, created on 2019-04-04, closed on 2019-04-15)*
* Relations:
* parent #10192
* Changesets:
* Revision 8d25ad814b36930f39f2c7d760a90f54c3350720 on 2019-04-08T12:25:53Z:
```
main/putty: security upgrade to 0.71
CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898
Fixes #10195
Update license, disable check
```3.8.5Jeff Bilykjbilyk@gmail.comJeff Bilykjbilyk@gmail.comhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/10194[3.9] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019...2019-07-23T11:12:26ZAlicha CH[3.9] putty: Multiple vulnerabilities (CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898)**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtath...**CVE-2019-9894**: A remotely triggerable memory overwrite in RSA key
exchange in
PuTTY before 0.71 can occur before host key verification.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9894
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=d82854999516046122501b2e145099740ed0284f
**CVE-2019-9895**: In PuTTY versions before 0.71 on Unix, a remotely
triggerable
buffer overflow exists in any kind of server-to-client forwarding.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://nvd.nist.gov/vuln/detail/CVE-2019-9895
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=5c926d9ea4a9e0a0a2384f06c7583648cdff3ed6
**CVE-2019-9897**: Multiple denial-of-service attacks that can be
triggered by writing
to the terminal exist in PuTTY versions before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://security-tracker.debian.org/tracker/CVE-2019-9897
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=da1c8f15b1bc14c855f0027cf06ba7f1a9c36f3c
**CVE-2019-9898**: Potential recycling of random numbers used in
cryptography exists within PuTTY before 0.71.
### Fixed In Version:
putty 0.71
### References:
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html
### Patch:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=320bf8479ff5bcbad239db4f9f4aa63656b0675e
*(from redmine: issue id 10194, created on 2019-04-04, closed on 2019-04-15)*
* Relations:
* parent #10192
* Changesets:
* Revision e68f4defc683245fe34f4caa1ad6b6c64e5e6c23 on 2019-04-08T12:21:32Z:
```
main/putty: security upgrade to 0.71
CVE-2019-9894, CVE-2019-9895, CVE-2019-9897, CVE-2019-9898
Fixes #10194
Update license, disable check
```3.9.3Jeff Bilykjbilyk@gmail.comJeff Bilykjbilyk@gmail.com