CVE-2015-2157
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not...
CVE-2015-2157 is a low vulnerability (CVSS 2.1) in Putty, published March 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. Fixed in putty 0.63-10.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.58%EPSS, 48th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.63-10putty +8 more
Description
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puttyDebian:12 | before 0.63-10 | 0.63-10 |
puttyDebian:13 | before 0.63-10 | 0.63-10 |
puttyDebian:14 | before 0.63-10 | 0.63-10 |
puttyDebian:6.0 | before 0.60+2010-02-20-1+squeeze3, plus listed versions 0.60+2010-02-20-10.60+2010-02-20-1+squeeze10.60+2010-02-20-1+squeeze2 | 0.60+2010-02-20-1+squeeze3 |
puttyDebian:7 | before 0.62-9+deb7u2, plus listed versions 0.62-90.62-9+deb7u1 | 0.62-9+deb7u2 |
puttyMageia:4 | before 0.64-1.mga4 | 0.64-1.mga4 |
filezillaMageia:4 | before 3.10.2-1.mga4 | 3.10.2-1.mga4 |
puttyUbuntu:14.04:LTS | before 0.63-4ubuntu0.1, plus listed versions 0.63-10.63-20.63-30.63-4 | 0.63-4ubuntu0.1 |
puttyopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 0.67-1.5 | 0.67-1.5 |
What each source reports
NVD Score used
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
CVE-2015-2157- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
CVE-2015-2157- Updated
- 2026-11-02
EUVDEUVD-2015-2266No score
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
EUVD-2015-2266- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cmw5-crx2-gx7rNo score
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not...
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
GHSA-cmw5-crx2-gx7r- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
CVE-2015-2157- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2157No score
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
DEBIAN-CVE-2015-2157- Updated
- 2026-11-02
OSVMGASA-2015-0098No score
Updated putty and filezilla packages fix CVE-2015-2157
Updated putty and filezilla packages fix security vulnerability:
PuTTY suite versions 0.51 to 0.63 fail to clear SSH-2 private key information from memory when loading and saving key files to disk, leading to potential disclosure. The issue affects keys stored on disk in encrypted and unencrypted form, and is present in PuTTY, Plink, PSCP, PSFTP, Pageant and PuTTYgen (CVE-2015-2157).
The putty package has been updated to version 0.64, fixing this and other issues. The filezilla package, which contains a bundled version of PuTTY, has also been updated, to version 3.10.2.
- Record
MGASA-2015-0098- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10374-1No score
putty-0.67-1.5 on GA media
These are all security issues fixed in the putty-0.67-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10374-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2157No score
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
- Record
UBUNTU-CVE-2015-2157- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
chiark.greenend.org.uk/~sgtatham/putty/changes.html
lists.fedoraproject.org/pipermail/package-announce/2015-March/151933.html
securityfocus.com/bid/72825
debian.org/security/2015/dsa-3190
openwall.com/lists/oss-security/2015/02/28/4
Show 15 moreShow less
lists.opensuse.org/opensuse-updates/2015-03/msg00032.html
nvd.nist.gov/vuln/detail/CVE-2015-2157
github.com/advisories/GHSA-cmw5-crx2-gx7r
security-tracker.debian.org/tracker/CVE-2015-2157
advisories.mageia.org/MGASA-2015-0098.html
bugs.mageia.org/show_bug.cgi?id=15394
filezilla-project.org/newsfeed.php
ubuntu.com/security/CVE-2015-2157
cve.org/CVERecord?id=CVE-2015-2157
suse.com/security/cve/CVE-2013-4852