PuTTY 0.85 is released. Also MAILING LIST DISCONTINUED!

[Simon Tatham]

PuTTY version 0.85 is released
------------------------------

This is a SECURITY UPDATE, fixing five recently reported
vulnerabilities. None of them is _known_ to be severe, but at least
one _potentially_ is. Apart from these updates and very minor bug
fixes, 0.85 is the same as 0.84. We urge users to upgrade.

All the pre-built binaries, and the source code, are now available
from the PuTTY website at

    https://www.chiark.greenend.org.uk/~sgtatham/putty/

0.85 fixes the following security vulnerabilities:

 - A crash (potentially exploitable) in Pageant, if you loaded a key
   still encrypted, and then tried to use it (causing Pageant to
   prompt for the passphrase), and then another client of Pageant
   deleted the key before you answered the passphrase prompt.

 - A buffer overflow in the OpenSSH encrypt-then-MAC cipher modes
   (although PuTTY doesn't use those by default), triggered by a
   server sending the largest permitted size of packet.

 - A buffer overflow in decrypting a private key, if the private key
   was provided to you by a third party who was malicious. (If you
   always generate your own keys, you're safe.)

 - Two denials of service: a malicious SSH server could send PuTTY
   into a tight loop, and a legitimate server or a MITM could cause
   PuTTY to consume unlimited memory at the start of an SSH
   connection.

A further announcement: THIS MAILING LIST IS BEING DISCONTINUED.
Releases will now be announced via an RSS feed at

    https://www.chiark.greenend.org.uk/~sgtatham/putty/releases.rss

See the PuTTY front-page news feed for more information.

Enjoy using PuTTY!

Cheers,
Simon

-- 
import hashlib; print((lambda p,q,g,y,r,s,m: (lambda w:(pow(g,int(hashlib.sha1(
m.encode('ascii')).hexdigest(),16)*w%q,p)*pow(y,r*w%q,p)%p)%q)(pow(s,q-2,q))==r
and s%q!=0 and m)(12342649995480866419, 2278082317364501, 1670428356600652640,
5398151833726432125, 645223105888478, 1916678356240619, "<anakin at pobox.com>"))