-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 21 Aug 2026 11:27:49 +0100
Source: putty
Architecture: source
Version: 0.85-3
Distribution: unstable
Urgency: medium
Maintainer: Colin Watson <cjwatson@debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Changes:
putty (0.85-3) unstable; urgency=medium
.
* Tag upstream branch properly so that `git debpush` uses the right
upstream commit.
.
putty (0.85-2) unstable; urgency=medium
.
* Re-tag following `git debpush` mistake.
.
putty (0.85-1) unstable; urgency=medium
.
* d/upstream/signing-key.asc: Drop 2023 release key; add 2026 release key
(https://www.chiark.greenend.org.uk/~sgtatham/putty/keys/release-2026.asc).
* New upstream release:
- SECURITY: Fix a remotely triggerable use-after-free in Pageant.
(Might be exploitable to execute code, although this is not proved.)
- SECURITY: Fix a remotely triggerable buffer overflow if the OpenSSH
encrypt-then-MAC cipher modes are in use. (However they are only used
if a server supports nothing else.)
- SECURITY: Fix a buffer overflow in private key decryption, if the
private key is constructed maliciously. (Only triggerable on purpose
if you let somebody else generate your key for you.)
- SECURITY (denial of service): A server could trigger a tight loop in
PuTTY, and even a MITM could make it consume unlimited memory at
startup.
Checksums-Sha1:
7d29dd64755a0f90b54f393d7f728383e955fc22 2700 putty_0.85-3.dsc
a925c16b4ecaf8d44df16eee4078daff46d9fa4e 18956 putty_0.85-3.debian.tar.xz
df7a645d3a30157d7982b02bda2bf311220f8c00 4932972 putty_0.85-3.git.tar.xz
7382ebf2bd45f4cb113bad3352a2ec1256bb1346 17648 putty_0.85-3_source.buildinfo
a9f0b3ed9b90a9f48615eb446a626fa107e33267 3023114 putty_0.85.orig.tar.gz
05bb5caf99a768adccafab73d1f91c1d179fb1ea 659 putty_0.85.orig.tar.gz.asc
Checksums-Sha256:
2d390682044a56a6f9f304b405c754361048c8a7ab8cc0f38c6523e963e0329c 2700 putty_0.85-3.dsc
789abee5bab2c01c39f98c25736a2395c749005f994fd457341768aef29cb430 18956 putty_0.85-3.debian.tar.xz
4b8065b5b608e6f0928d3eed7b16a6cdfa7e4cb861d2a7306737e9ed6a8b1edf 4932972 putty_0.85-3.git.tar.xz
ec851ba56925a60831fc9061f35b5d1db11efa2e472b4c9a635ed25c084114ee 17648 putty_0.85-3_source.buildinfo
13fd4db2936d03b73812a7bcc2a658e4dd29cc776a56c3670a7fc6f1a0ee8af8 3023114 putty_0.85.orig.tar.gz
15193269e8f6fcbe9d277161cd562700eb1182479a8ef0dd6e2ec5bec2ad3b87 659 putty_0.85.orig.tar.gz.asc
Files:
1b2b0a95d224366edd0e9200bc7a6de7 2700 net optional putty_0.85-3.dsc
8e95f07f8068a0fc90b7f8c953bcaf33 18956 net optional putty_0.85-3.debian.tar.xz
87743ea3576f1d8d77dc2b0340bf6731 4932972 net optional putty_0.85-3.git.tar.xz
13ea6a82f4f1abda3f9a3c657a6faba4 17648 net optional putty_0.85-3_source.buildinfo
2624fd336c6411ddc4b80223717a562c 3023114 net optional putty_0.85.orig.tar.gz
667f8dae75971146c6ea1a5b39bc4fb8 659 net optional putty_0.85.orig.tar.gz.asc
Git-Tag-Info: tag=04749a5dd783efe5225bee213a2b68805cd5217c fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <cjwatson@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqIKZcACgkQYG0ITkaD
wHlUaRAAo3F4xlW5XH8hDrzaz/cBcV82q9OH/caLGBaD7EumEObNLTZQevMdGNe/
THu4qctHXTIpYLYbn7mMNOoPkGavTuCRuYHThvbafGhPUsiCEypEf0jOUOSLuCgc
dIJ8SrcHbvFemoFjSuotuHPNOPUryfB4r5LhpR7pL3p1xJdo5bcDBb02rL/dJCUR
DjxLifnkfG3H8c1/CHzjG/nGKrjVQYBl4CPFwZP6c9Qwh2liSXdr3QjQ3ej4EIeF
l2cV85zBLCIPh3GBBHW5mG9jvyRsI2V/6v3NSTJbr/ATdsmAay1bYVtJinVY5+OU
6YmaqWiB/tM0CWqMHEP8gJR09qPqJwjr1DQ2h1namI9hXrAZn4UxKNYEwm/K6vMn
sG8f09FkZtrrQfsL9ySaL9Or1ogHplCr5x8UmybGul4ck07KY3KiOq1/d2sRncRz
G4V+fr4x6LdqmlMrXQqeAYmbBEf8+5sThj3TmAKp4vnhP8b2Zrw3X2QnIpYhbpqm
y9JkMor2G+Ci72qYvQu6HGbTDHTiaduaVaQGKFhR/J41xfzrCwVJWIyLvp8P8I/c
pZ7X4XCKEHxcnj7BcvZZy3qddQd00CJD9xGFRdlVOclivly3BFZtSYMjR/X2apjx
aHNS6Esh1LmkycJ4fbwceArIT7+MTe+YkxGbMtkOF1fk15kShAM=
=mQtM
-----END PGP SIGNATURE-----
