{"id":"CVE-2015-2157","aliases":["DEBIAN-CVE-2015-2157","DLA-173-1","DSA-3190-1","EUVD-2015-2266","GHSA-cmw5-crx2-gx7r","MGASA-2015-0098","UBUNTU-CVE-2015-2157","openSUSE-SU-2024:10374-1"],"status":"published","title":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not...","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00585,"percentile":0.48225,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-03-06T18:08:57Z","modified":"2026-09-09T06:47:31Z","fixes":[{"ecosystem":"Debian:12","package":"putty","fixed_in":["0.63-10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"putty","fixed_in":["0.63-10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"putty","fixed_in":["0.63-10"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"putty","fixed_in":["0.60+2010-02-20-1+squeeze3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"putty","fixed_in":["0.62-9+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"putty","fixed_in":["0.64-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"filezilla","fixed_in":["3.10.2-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"putty","fixed_in":["0.63-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-10"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-10"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60+2010-02-20-1+squeeze3"}]}],"versions":["0.60+2010-02-20-1","0.60+2010-02-20-1+squeeze1","0.60+2010-02-20-1+squeeze2"]},{"source":"osv","ecosystem":"Debian:7","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62-9+deb7u2"}]}],"versions":["0.62-9","0.62-9+deb7u1"]},{"source":"osv","ecosystem":"Mageia:4","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.64-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.2-1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-4ubuntu0.1"}]}],"versions":["0.63-1","0.63-2","0.63-3","0.63-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67-1.5"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"putty","product":"putty"},{"vendor":"simon_tatham","product":"putty"}],"references":[{"url":"http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151933.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/72825","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3190","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151790.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/28/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/28/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151839.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2157"},{"url":"https://github.com/advisories/GHSA-cmw5-crx2-gx7r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-2157","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0098.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15394","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/02/28/4","tags":["web"]},{"url":"https://filezilla-project.org/newsfeed.php","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-2157","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2157","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5309","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-2157","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2015-03-27T14:00:00Z","modified":"2024-08-06T05:10:14.276Z","updated_at":"2026-11-02T14:35:41.621934Z"}],"euvd":[{"id":"EUVD-2015-2266","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2015-03-27T14:00:00Z","modified":"2024-08-06T05:10:14Z","updated_at":"2026-11-03T02:22:12.830256Z"}],"ghsa":[{"id":"GHSA-cmw5-crx2-gx7r","title":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not...","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2022-05-14T01:18:14Z","modified":"2023-02-02T05:03:29Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:38.861054Z"}],"nvd":[{"id":"CVE-2015-2157","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2015-03-27T14:59:05.697Z","modified":"2026-06-17T00:23:41.533Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CVE-2015-2157","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2015-03-27T14:59:05Z","modified":"2026-04-16T06:17:04.568313191Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-2157","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2015-03-27T14:59:05.697Z","modified":"2026-09-09T06:47:31.128396314Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-173-1","title":"putty - security update","status":"published","published":"2015-03-15T00:00:00Z","modified":"2026-03-09T01:18:17.150785Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3190-1","title":"putty - security update","status":"published","published":"2015-03-15T00:00:00Z","modified":"2026-03-09T01:20:10.45367Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0098","title":"Updated putty and filezilla packages fix CVE-2015-2157","description":"Updated putty and filezilla packages fix security vulnerability:\n\nPuTTY suite versions 0.51 to 0.63 fail to clear SSH-2 private key\ninformation from memory when loading and saving key files to disk,\nleading to potential disclosure. The issue affects keys stored on disk\nin encrypted and unencrypted form, and is present in PuTTY, Plink,\nPSCP, PSFTP, Pageant and PuTTYgen (CVE-2015-2157).\n\nThe putty package has been updated to version 0.64, fixing this and other\nissues.  The filezilla package, which contains a bundled version of PuTTY,\nhas also been updated, to version 3.10.2.\n","status":"published","published":"2015-03-06T18:08:57Z","modified":"2026-04-16T06:25:06.620435096Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10374-1","title":"putty-0.67-1.5 on GA media","description":"These are all security issues fixed in the putty-0.67-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:29:46.641984Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2015-2157","description":"The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.","status":"published","published":"2015-03-27T14:59:00Z","modified":"2025-09-08T16:43:20Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}