Change log for putty package in Debian

putty (0.81-1) unstable; urgency=high

  * Build-depend on pkgconf rather than pkg-config.
  * New upstream release:
    - CVE-2024-31497: Fix exposure of NIST P521 ECDSA private keys by biased
      signature generation.

 -- Colin Watson <email address hidden>  Mon, 15 Apr 2024 23:41:28 +0100

Available diffs

• diff from 0.80-1build3 (in Ubuntu) to 0.81-1 (28.4 KiB)

putty (0.74-1+deb11u1) bullseye-security; urgency=medium

  * Cherry-pick from upstream:
    - CVE-2021-36367: New option to reject 'trivial' success of userauth
      (closes: #990901).
    - New macro PTRLEN_DECL_LITERAL.
    - Extra utility function add_to_commasep_pl.
    - CVE-2023-48795: Support OpenSSH's new strict kex feature (thanks to
      Simon Tatham for backporting assistance).
    Note that this does _not_ include upstream's added UI warning for
    servers vulnerable to Terrapin, which was too difficult to backport to
    this version.

 -- Colin Watson <email address hidden>  Fri, 22 Dec 2023 17:36:21 +0000

putty (0.78-2+deb12u1) bookworm-security; urgency=medium

  * CVE-2023-48795: Cherry-pick from upstream:
    - Fix check for "ext-info-s".
    - Factor out the check for ext-info-* keyword.
    - Refactor confirm_weak to use SeatDialogText.
    - Support OpenSSH's new strict kex feature.
    - Add missing flags to AES selector vtables.
    - Warn about Terrapin vulnerability for unpatched servers.
    - Remove fatal-error reporting from scan_kexinits.
    - Terrapin warning: say if reconfiguration can help.

 -- Colin Watson <email address hidden>  Mon, 18 Dec 2023 19:13:57 +0000

putty (0.80-1) unstable; urgency=high

  * New upstream release:
    - CVE-2023-48795: Mitigations for SSH protocol 'Terrapin' vulnerability.

 -- Colin Watson <email address hidden>  Mon, 18 Dec 2023 17:42:06 +0000

Available diffs

• diff from 0.79-1 to 0.80-1 (22.4 KiB)

putty (0.79-1) unstable; urgency=medium

  * debian/upstream/signing-key.asc: Drop 2018 release key; add 2023 release
    key
    (https://www.chiark.greenend.org.uk/~sgtatham/putty/keys/release-2023.asc).
  * New upstream release:
    - GTK: fix crash changing font size when terminal maximised (closes:
      #1038788).

 -- Colin Watson <email address hidden>  Sun, 27 Aug 2023 22:36:26 +0100

Available diffs

• diff from 0.78-3 to 0.79-1 (60.9 KiB)

putty (0.78-3) unstable; urgency=medium

  * Clean icons/*.svg (closes: #1047016).

 -- Colin Watson <email address hidden>  Mon, 14 Aug 2023 13:48:06 +0100

Available diffs

• diff from 0.78-2 to 0.78-3 (472 bytes)

putty (0.78-2) unstable; urgency=medium

  [ Pino Toscano ]
  * Drop menu files, since pterm and putty already provide a .desktop file.
  * Stop shipping pterm.xpm and putty.xpm, as they were needed only by the
    menu files.
  * Ship all the available PNG icons to the XDG hicolor icon theme, so they
    can be loaded properly depending on the size, and even themed.
  * Stop shipping the PNG icons in the legacy pixmaps directory, as the hicolor
    icons will be enough now.
  * Build also the SVG icons, and ship them in the XDG hicolor icon theme.
  * Annotate python3 build dependency as :any, as it is needed only as a tool
    during the build.

 -- Colin Watson <email address hidden>  Sun, 18 Dec 2022 14:57:23 +0000

Available diffs

• diff from 0.78-1 to 0.78-2 (1.3 KiB)

putty (0.78-1) unstable; urgency=medium

  * New upstream release.
  * Update Lintian override to current syntax.
  * debian/watch: Upgrade to version 4.
  * debian/copyright: Convert to copyright-format 1.0.
  * Override Lintian source-is-missing misfire (see #1019980).

 -- Colin Watson <email address hidden>  Sat, 29 Oct 2022 14:31:42 +0100

Available diffs

• diff from 0.77-1 to 0.78-1 (478.8 KiB)

putty (0.77-1) unstable; urgency=medium

  * Use dh_installalternatives.
  * Simplify some debhelper overrides slightly.
  * Update upstream release signing keys (see
    https://www.chiark.greenend.org.uk/~sgtatham/putty/keys.html).
  * New upstream release.
  * Rework packaging somewhat to handle upstream's switch to CMake.

 -- Colin Watson <email address hidden>  Tue, 31 May 2022 10:28:05 +0100

Available diffs

• diff from 0.76-2 to 0.77-1 (2.8 MiB)

putty (0.76-2) unstable; urgency=medium

  * Upgrade to debhelper v13.
  * Build documentation from source using halibut (fixes bug where man page
    patches in 0.76-1 were ineffective).

 -- Colin Watson <email address hidden>  Tue, 21 Dec 2021 00:48:30 +0000

Available diffs

• diff from 0.76-1 to 0.76-2 (2.0 KiB)

putty (0.76-1) unstable; urgency=medium

  * New upstream release.
  * Cherry-pick from upstream:
    - psusan manpage: add a PATH to the UML example (closes: #991960).
    - Bug workaround to delay sending our SSH greeting (see #991958).

 -- Colin Watson <email address hidden>  Mon, 16 Aug 2021 00:29:11 +0100

Available diffs

• diff from 0.75-3 to 0.76-1 (45.3 KiB)

putty (0.75-3) unstable; urgency=medium

  * Cherry-pick from upstream:
    - CVE-2021-36367: New option to reject 'trivial' success of userauth
      (closes: #990901).

 -- Colin Watson <email address hidden>  Sun, 11 Jul 2021 00:35:09 +0100

Available diffs

• diff from 0.75-2 to 0.75-3 (7.4 KiB)

putty (0.75-2) unstable; urgency=medium

  * Add psusan to putty-tools.

 -- Colin Watson <email address hidden>  Wed, 02 Jun 2021 15:03:48 +0100

Available diffs

• diff from 0.75-1 to 0.75-2 (980 bytes)

putty (0.75-1) unstable; urgency=medium

  * New upstream release.

 -- Colin Watson <email address hidden>  Sun, 09 May 2021 11:24:32 +0100

Available diffs

• diff from 0.74-1 to 0.75-1 (841.9 KiB)

putty (0.74-1) unstable; urgency=medium

  * New upstream release.
    - SECURITY: Key list from agent used after free if server rejects
      signature after PK_OK.
    - CVE-2020-14002: Dynamic host key policy leaks information about known
      host keys.

 -- Colin Watson <email address hidden>  Sat, 27 Jun 2020 13:43:16 +0100

Available diffs

• diff from 0.73-3 to 0.74-1 (72.6 KiB)

putty (0.73-3) unstable; urgency=medium

  * Cherry-pick from upstream:
    - pty_backend_create: set up SIGCHLD handler earlier (closes: #959396).

 -- Colin Watson <email address hidden>  Fri, 08 May 2020 15:52:01 +0100

Available diffs

• diff from 0.73-2 to 0.73-3 (1.4 KiB)

putty (0.73-2) unstable; urgency=medium

  * Cherry-pick from upstream:
    - gtkfont: use PANGO_PIXELS_CEIL to work out font metrics (fixes
      rendering regression at some font sizes with Pango 1.44).

 -- Colin Watson <email address hidden>  Sun, 05 Apr 2020 12:22:42 +0100

Available diffs

• diff from 0.73-1 to 0.73-2 (1.5 KiB)

putty (0.73-1) unstable; urgency=medium

  * New upstream release.

 -- Colin Watson <email address hidden>  Sun, 29 Sep 2019 17:10:38 +0100

Available diffs

• diff from 0.72-1 to 0.73-1 (600.6 KiB)

putty (0.72-2) unstable; urgency=medium

  * Use debhelper-compat instead of debian/compat.
  * Port mkicon.py to Python 3 and drop build-dependency on python (closes:
    #937380).

 -- Colin Watson <email address hidden>  Sat, 31 Aug 2019 21:46:04 +0100

putty (0.72-1) unstable; urgency=medium

  * New upstream release.
  * Explicitly build-depend on python3, for test/cryptsuite.py.

 -- Colin Watson <email address hidden>  Tue, 23 Jul 2019 10:49:47 +0100

Available diffs

• diff from 0.70-6 to 0.72-1 (1.6 MiB)

putty (0.67-3+deb9u1) stretch-security; urgency=high

  * Backport security fixes from 0.71:
    - In random_add_noise, put the hashed noise into the pool, not the raw
      noise.
    - New facility for removing pending toplevel callbacks.
    - CVE-2019-9898: Fix one-byte buffer overrun in random_add_noise().
    - uxnet: clean up callbacks when closing a NetSocket.
    - sk_tcp_close: fix memory leak of output bufchain.
    - Fix handling of bad RSA key with n=p=q=0.
    - Sanity-check the 'Public-Lines' field in ppk files.
    - Introduce an enum of the uxsel / select_result flags.
    - CVE-2019-9895: Switch to using poll(2) in place of select(2).
    - CVE-2019-9894: RSA kex: enforce the minimum key length.
    - CVE-2019-9897: Fix crash on ESC#6 + combining chars + GTK + odd-width
      terminal.
    - CVE-2019-9897: Limit the number of combining chars per terminal cell.
    - minibidi: fix read past end of line in rule W5.
    - CVE-2019-9897: Fix crash printing a width-2 char in a width-1
      terminal.

 -- Colin Watson <email address hidden>  Tue, 02 Apr 2019 19:32:53 +0100

putty (0.71-1) experimental; urgency=medium

  * Add new upstream release signing key to debian/upstream/signing-key.asc
    (see https://www.chiark.greenend.org.uk/~sgtatham/putty/keys.html).
  * New upstream release (see
    https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html).
    - Make "putty user@host" work (closes: #509194).

 -- Colin Watson <email address hidden>  Wed, 20 Mar 2019 13:11:14 +0000

putty (0.70-6) unstable; urgency=high

  * Apply security patch series from upstream:
    - New facility for removing pending toplevel callbacks.
    - Fix one-byte buffer overrun in random_add_noise().
    - uxnet: clean up callbacks when closing a NetSocket.
    - sk_tcp_close: fix memory leak of output bufchain.
    - Fix handling of bad RSA key with n=p=q=0.
    - Sanity-check the 'Public-Lines' field in ppk files.
    - Introduce an enum of the uxsel / select_result flags.
    - Switch to using poll(2) in place of select(2).
    - RSA kex: enforce the minimum key length.
    - Fix crash on ESC#6 + combining chars + GTK + odd-width terminal.
    - Limit the number of combining chars per terminal cell.
    - minibidi: fix read past end of line in rule W5.
    - Fix crash printing a width-2 char in a width-1 terminal.

 -- Colin Watson <email address hidden>  Sun, 17 Mar 2019 09:37:02 +0000

Available diffs

• diff from 0.70-5 to 0.70-6 (18.6 KiB)

putty (0.70-5) unstable; urgency=medium

  [ Colin Watson ]
  * Mark all binary packages Multi-Arch: foreign.
  * Configure with --disable-git-commit to avoid a build failure due to
    trying to redefine SOURCE_COMMIT when building from the Debian git tree.
  * Cherry-pick from upstream:
    - Remove a fixed-size buffer in pscp.c (closes: #911955).
    - Remove a fixed-size buffer in cmdgen.c.
    - Stop using deprecated gtk_container_set_focus_chain().

  [ Niels Thykier ]
  * Declare the explicit requirement for (fake)root.

 -- Colin Watson <email address hidden>  Sun, 28 Oct 2018 18:07:45 +0000

Available diffs

• diff from 0.70-4 to 0.70-5 (5.4 KiB)

putty (0.70-4) unstable; urgency=medium

  * Cherry-pick from upstream:
    - Ignore spurious configure_area events, which caused a lot of
      flickering on GTK+ 3.

 -- Colin Watson <email address hidden>  Thu, 05 Apr 2018 00:27:48 +0100

Available diffs

• diff from 0.70-3 to 0.70-4 (1.7 KiB)

putty (0.70-3) unstable; urgency=medium

  * Use GDK_BACKEND x11 when built with X support (thanks, Andreas
    Henriksson; closes: #861603).

 -- Colin Watson <email address hidden>  Tue, 03 Apr 2018 02:03:31 +0100

Available diffs

• diff from 0.70-2 to 0.70-3 (1.5 KiB)

putty (0.70-2) unstable; urgency=medium

  * Move VCS to salsa.debian.org.
  * Cherry-pick from upstream:
    - Use gdk_display_beep() in place of obsolete gdk_beep() (closes:
      #891519).

 -- Colin Watson <email address hidden>  Sun, 04 Mar 2018 18:20:39 +0000

Available diffs

• diff from 0.70-1 to 0.70-2 (1.8 KiB)

putty (0.70-1) unstable; urgency=medium

  * New upstream release.

 -- Colin Watson <email address hidden>  Sat, 08 Jul 2017 13:19:23 +0100

Available diffs

• diff from 0.69-2 to 0.70-1 (73.0 KiB)

putty (0.69-2) unstable; urgency=medium

  * Update Homepage and debian/copyright download URL to use HTTPS.
  * Upload to unstable.

 -- Colin Watson <email address hidden>  Sun, 18 Jun 2017 12:20:31 +0100

Available diffs

• diff from 0.69-1 to 0.69-2 (718 bytes)

putty (0.69-1) experimental; urgency=medium

  * New upstream release.

 -- Colin Watson <email address hidden>  Sat, 29 Apr 2017 13:14:57 +0100

Available diffs

• diff from 0.68-2 to 0.69-1 (91.5 KiB)

putty (0.68-2) experimental; urgency=medium

  * Move pageant from putty-tools to putty, since it depends on GTK+
    (thanks, Dr. Markus Waldeck).

 -- Colin Watson <email address hidden>  Sun, 02 Apr 2017 17:26:23 +0100

Available diffs

• diff from 0.67-3 to 0.68-2 (717.2 KiB)

putty (0.68-1) experimental; urgency=medium

  * New upstream release.
    - Supports elliptic-curve cryptography for host keys, user
      authentication keys, and key exchange (closes: #854287).
    - Ported to GTK+ 3.
  * Use HTTPS URL in debian/watch.
  * Install Pageant, which is now ported to Unix.
  * Cherry-pick a set of upstream patches to get things working with GTK+
    3.22:
    - Handle GTK 3.22's deprecation of gdk_cairo_create().
    - Handle deprecation of gtk_menu_popup.
    - Use CSS to set window backgrounds with GTK+ 3.
    - Handle deprecation of gdk_screen_{width,height}.
    - Replace deprecated gtk_window_set_wmclass with raw Xlib.
    - Change Cairo image surface type from RGB24 to ARGB32.
  * Update download URL in debian/copyright (thanks, Dr. Markus Waldeck).

 -- Colin Watson <email address hidden>  Sun, 02 Apr 2017 00:16:29 +0100

putty (0.67-3) unstable; urgency=high

  * CVE-2017-6542: Sanity-check message length fields in CHAN_AGENT input
    (thanks, Simon Tatham; closes: #857642).

 -- Colin Watson <email address hidden>  Wed, 22 Mar 2017 14:42:13 +0000

Available diffs

• diff from 0.67-2 to 0.67-3 (2.1 KiB)

putty (0.62-9+deb7u3) wheezy-security; urgency=high

  * More robust control sequence parameter handling, including:
    - CVE-2015-5309: Fix a potentially memory-corrupting integer overflow in
      the handling of the ECH (erase characters) control sequence in the
      terminal emulator.

 -- Colin Watson <email address hidden>  Sun, 29 Nov 2015 00:10:04 +0000

putty (0.67-2) unstable; urgency=medium

  * Backport from upstream:
    - Add command-line passphrase-file options to command-line PuTTYgen.

 -- Colin Watson <email address hidden>  Fri, 18 Mar 2016 22:32:33 +0000

Available diffs

• diff from 0.67-1 to 0.67-2 (4.2 KiB)

putty (0.67-1) unstable; urgency=high

  * New upstream release.
    - CVE-2016-2563: Fix buffer overrun in the old-style SCP protocol
      (closes: #816921).

 -- Colin Watson <email address hidden>  Sun, 06 Mar 2016 18:41:16 +0000

Available diffs

• diff from 0.66-4 to 0.67-1 (58.4 KiB)

putty (0.66-4) unstable; urgency=medium

  * Use HTTPS for Vcs-* URLs, and link to cgit rather than gitweb.
  * Fix misleading-indentation and strict-aliasing warnings from GCC 6
    (closes: #811581).

 -- Colin Watson <email address hidden>  Fri, 05 Feb 2016 13:47:21 +0000

Available diffs

• diff from 0.66-3 to 0.66-4 (2.6 KiB)

putty (0.63-10+deb8u1) jessie-security; urgency=high

  * More robust control sequence parameter handling, including:
    - CVE-2015-5309: Fix a potentially memory-corrupting integer overflow in
      the handling of the ECH (erase characters) control sequence in the
      terminal emulator.

 -- Colin Watson <email address hidden>  Sun, 29 Nov 2015 00:31:44 +0000

putty (0.66-3) unstable; urgency=medium

  * Add a Homepage field.
  * Add Keywords fields to pterm.desktop and putty.desktop.
  * Build with large file support.

 -- Colin Watson <email address hidden>  Mon, 04 Jan 2016 15:18:57 +0000

Available diffs

• diff from 0.66-2 to 0.66-3 (900 bytes)

putty (0.66-2) unstable; urgency=medium

  * Fix dh_fixperms override to work properly with an
    architecture-independent-only build (closes: #806098).
  * Do much less work in architecture-independent-only builds.
  * Fix build failure on GNU/Hurd (closes: #805505).

 -- Colin Watson <email address hidden>  Tue, 24 Nov 2015 17:10:21 +0000

Available diffs

• diff from 0.66-1 to 0.66-2 (1.4 KiB)

putty (0.66-1) unstable; urgency=high

  * New upstream release.
    - CVE-2015-5309: Fix a potentially memory-corrupting integer overflow in
      the handling of the ECH (erase characters) control sequence in the
      terminal emulator.
  * Use dh-exec to remove the need to override dh_install.
  * Add OpenPGP signature checking configuration to watch file.

 -- Colin Watson <email address hidden>  Sat, 07 Nov 2015 16:10:41 +0000

Available diffs

• diff from 0.65-2 to 0.66-1 (57.9 KiB)

putty (0.62-9+deb7u2) stable-security; urgency=high

  * Backport from upstream:
    - MATTA-2015-002: Enforce acceptable range for Diffie-Hellman server
      value.
    - Fix an erroneous length field in SSH-1 key load.
    - CVE-2015-2157: Fix failure to clear sensitive private key information
      from memory (closes: #779488).

 -- Colin Watson <email address hidden>  Sat, 14 Mar 2015 12:56:58 +0000

putty (0.65-2) unstable; urgency=medium

  * Backport from upstream:
    - Performance: cache character widths returned from Pango (closes:
      #792258).

 -- Colin Watson <email address hidden>  Sun, 23 Aug 2015 18:47:52 +0100

Available diffs

• diff from 0.65-1 to 0.65-2 (2.6 KiB)

putty (0.65-1) unstable; urgency=medium

  * New upstream release.

 -- Colin Watson <email address hidden>  Tue, 28 Jul 2015 11:18:13 +0100

Available diffs

• diff from 0.64-1 to 0.65-1 (40.8 KiB)

putty (0.64-1) unstable; urgency=medium

  * New upstream release.
    - Support sharing an SSH connection between multiple instances of PuTTY
      and its tools.
    - Add a command-line and config option to specify the expected host
      key(s).

 -- Colin Watson <email address hidden>  Sun, 14 Jun 2015 11:03:52 +0100

Available diffs

• diff from 0.63-10 to 0.64-1 (559.7 KiB)

putty (0.63-10) unstable; urgency=medium


  * Backport from upstream:
    - Make kh2reg.py compatible with modern Python.
    - MATTA-2015-002: Enforce acceptable range for Diffie-Hellman server
      value.
    - Fix an erroneous length field in SSH-1 key load.
    - CVE-2015-2157: Fix failure to clear sensitive private key information
      from memory (closes: #779488).

 -- Colin Watson <email address hidden>  Sun, 01 Mar 2015 12:59:15 +0000

Available diffs

• diff from 0.63-9 to 0.63-10 (4.3 KiB)

putty (0.63-9) unstable; urgency=medium


  * Backport from upstream (Simon Tatham):
    - Revert the default for font bolding style back to using colours rather
      than fonts (closes: #772948).

 -- Colin Watson <email address hidden>  Sat, 13 Dec 2014 10:11:04 +0000

Available diffs

• diff from 0.63-8 to 0.63-9 (1.4 KiB)

putty (0.63-8) unstable; urgency=medium


  * Backport from upstream (Simon Tatham), suggested by Jacob Nevins:
    - Fix incorrect handling of saved sessions with a dynamic SOCKS tunnel
      bound to a specific protocol (IPv4 or IPv6).

 -- Colin Watson <email address hidden>  Sun, 12 Oct 2014 20:47:42 +0100

Available diffs

• diff from 0.63-7 to 0.63-8 (2.3 KiB)

putty (0.63-7) unstable; urgency=medium


  * Build with all hardening options.  (Thanks to somebody whose e-mail I
    unfortunately deleted by mistake and so cannot reply to it ...)

 -- Colin Watson <email address hidden>  Sun, 24 Aug 2014 00:29:36 +0100

Available diffs

• diff from 0.63-5 to 0.63-7 (2.4 KiB)

putty (0.63-6) unstable; urgency=medium


  * Backport two upstream patches to fix runaway timer explosions (closes:
    #758473).

 -- Colin Watson <email address hidden>  Wed, 20 Aug 2014 21:05:52 +0100

putty (0.63-5) unstable; urgency=medium


  * Backport from upstream (Simon Tatham):
    - Fix an annoying timer-handling warning from current versions of GTK.

 -- Colin Watson <email address hidden>  Mon, 21 Apr 2014 21:57:57 +0100

Available diffs

• diff from 0.63-4 to 0.63-5 (1.3 KiB)

putty (0.63-4) unstable; urgency=medium


  * Backport from upstream (Simon Tatham):
    - Fix assertion failure in Unix PuTTYgen exports (LP: #1289176).

 -- Colin Watson <email address hidden>  Tue, 08 Apr 2014 12:19:08 +0100

Available diffs

• diff from 0.63-3 to 0.63-4 (1.2 KiB)

putty (0.63-3) unstable; urgency=medium


  * Use dh-autoreconf, with the aid of a few upstream patches to make things
    work with current autotools.
  * Backport upstream patch to add some assertions in sshzlib.c, fixing
    build with -O3.

 -- Colin Watson <email address hidden>  Wed, 12 Mar 2014 12:07:04 +0000

Available diffs

• diff from 0.63-2 to 0.63-3 (56.5 KiB)

putty (0.63-2) unstable; urgency=low


  * Support parallel builds.
  * Switch to git; adjust Vcs-* fields.

 -- Colin Watson <email address hidden>  Wed, 08 Jan 2014 13:01:57 +0000

Available diffs

• diff from 0.63-1 to 0.63-2 (682 bytes)

putty (0.60+2010-02-20-1+squeeze2) oldstable-security; urgency=high


  * CVE-2011-4607: Passwords were left in memory using SSH
    keyboard-interactive auth.
  * CVE-2013-4206: Buffer underrun in modmul could corrupt the heap.
  * CVE-2013-4852: Negative string length in public-key signatures could
    cause integer overflow and overwrite all of memory (closes: #718779).
  * CVE-2013-4207: Non-coprime values in DSA signatures can cause buffer
    overflow in modular inverse.
  * CVE-2013-4208: Private keys were left in memory after being used by
    PuTTY tools.
  * Backport some general proactive potentially-security-relevant tightening
    from upstream.

 -- Colin Watson <email address hidden>  Thu, 08 Aug 2013 23:37:19 +0100

putty (0.62-9+deb7u1) stable-security; urgency=high


  * CVE-2013-4206: Buffer underrun in modmul could corrupt the heap.
  * CVE-2013-4852: Negative string length in public-key signatures could
    cause integer overflow and overwrite all of memory (closes: #718779).
  * CVE-2013-4207: Non-coprime values in DSA signatures can cause buffer
    overflow in modular inverse.
  * CVE-2013-4208: Private keys were left in memory after being used by
    PuTTY tools.
  * Backport some general proactive potentially-security-relevant tightening
    from upstream.

 -- Colin Watson <email address hidden>  Wed, 07 Aug 2013 10:11:18 +0100

putty (0.63-1) unstable; urgency=low


  * New upstream release.
    - CVE-2013-4206: Buffer underrun in modmul could corrupt the heap.
    - CVE-2013-4852: Negative string length in public-key signatures could
      cause integer overflow and overwrite all of memory (closes: #718779).
    - CVE-2013-4207: Non-coprime values in DSA signatures can cause buffer
      overflow in modular inverse.
    - CVE-2013-4208: Private keys were left in memory after being used by
      PuTTY tools.
    - Allow using a bold colour and a bold font at the same time (closes:
      #193352).
    - Use a monotonic clock (closes: #308552).
  * Switch to the Autotools-based build system.
  * Upgrade to debhelper v9.

 -- Colin Watson <email address hidden>  Wed, 07 Aug 2013 04:00:18 +0100

Available diffs

• diff from 0.62-11 to 0.63-1 (494.2 KiB)

putty (0.62-11) unstable; urgency=low


  * Backport from upstream (Ben Harris, Simon Tatham):
    - Avoid function pointer comparison when using clang.

 -- Colin Watson <email address hidden>  Tue, 04 Jun 2013 15:45:00 +0100

Available diffs

• diff from 0.62-10 to 0.62-11 (869 bytes)

putty (0.62-10) unstable; urgency=low


  * Backport from upstream (Simon Tatham, closes: #701425):
    - Check the return values of setuid and friends.
    - Remove the half-hearted attempt to make the utmp helper process drop
      privileges just before dying of a fatal signal.

 -- Colin Watson <email address hidden>  Mon, 25 Feb 2013 20:36:40 +0000

Available diffs

• diff from 0.62-9 to 0.62-10 (1.2 KiB)

putty (0.62-9) unstable; urgency=low


  * Backport from upstream (Simon Tatham):
    - Fix handling of non-default numeric keypad modes when Num Lock is on
      (closes: #680261).

 -- Colin Watson <email address hidden>  Thu, 23 Aug 2012 12:58:52 +0100

Available diffs

• diff from 0.62-8 to 0.62-9 (2.3 KiB)

putty (0.62-8) unstable; urgency=low


  * Backport from upstream (Simon Tatham):
    - Support dead keys and compose sequences (closes: #221786, #250464).

 -- Colin Watson <email address hidden>  Fri, 22 Jun 2012 15:18:51 +0100

Available diffs

• diff from 0.62-7 to 0.62-8 (2.7 KiB)

putty (0.62-7) unstable; urgency=low


  * Add System category to pterm.desktop (closes: #678126).
  * Use dpkg-buildflags to enable hardening options.

 -- Colin Watson <email address hidden>  Tue, 19 Jun 2012 13:28:15 +0100

Available diffs

• diff from 0.62-6 to 0.62-7 (987 bytes)

putty (0.62-6) unstable; urgency=low


  * Backport from upstream (Simon Tatham, Jacob Nevins):
    - Generate keys more carefully, so that when the user asks for an n-bit
      key they always get an n-bit number instead of n-1.  The latter was
      perfectly harmless but kept confusing users (closes: #661152).

 -- Colin Watson <email address hidden>  Sun, 04 Mar 2012 16:09:28 +0000

Available diffs

• diff from 0.62-3 to 0.62-6 (3.8 KiB)

putty (0.62-5) unstable; urgency=low


  * Ignore failures to generate PNG icons too.

 -- Colin Watson <email address hidden>  Wed, 08 Feb 2012 19:51:39 +0000

putty (0.62-4) unstable; urgency=low


  * Ignore failures to generate XPM icons.  It's not the end of the world,
    and this fails on kFreeBSD due to some apparently undiagnosed
    imagemagick bug.
  * Drop icon-debug.patch, since it didn't especially help anyway.

 -- Colin Watson <email address hidden>  Wed, 08 Feb 2012 15:42:14 +0000

putty (0.62-3) unstable; urgency=low


  * Fix icon-debug.patch to print debug information to stderr, not stdout.

 -- Colin Watson <email address hidden>  Tue, 03 Jan 2012 21:34:28 +0000

Available diffs

• diff from 0.62-1ubuntu1 (in Ubuntu) to 0.62-3 (2.2 KiB)

putty (0.62-2) unstable; urgency=low


  * Avoid deprecated GLib functions.
  * Add temporary debugging patch to try to figure out why the
    kfreebsd-amd64 build is failing.

 -- Colin Watson <email address hidden>  Tue, 03 Jan 2012 18:14:45 +0000

putty (0.62-1) unstable; urgency=high


  * New upstream release.
    - [SECURITY] Wipe SSH keyboard-interactive replies from memory after
      authentication.

 -- Colin Watson <email address hidden>  Mon, 12 Dec 2011 02:05:49 +0000

Available diffs

• diff from 0.61-2 (in Ubuntu) to 0.62-1 (13.8 KiB)

putty (0.61-2) unstable; urgency=low


  * Add cross-compiling support.

 -- Colin Watson <email address hidden>  Tue, 27 Sep 2011 14:29:27 +0100

putty (0.61-1) unstable; urgency=low
  * New upstream release.  * Update Vcs-* fields for Alioth changes. -- Colin Watson <email address hidden>  Wed, 13 Jul 2011 15:26:33 +0100

putty (0.60+2011-05-09-1) unstable; urgency=low
  * New experimental development snapshot.    - Compiles cleanly with GCC 4.6 (closes: #625113, #625426).  * Consistently capitalise SSH in the package description when referring to    the protocol (closes: #610486). -- Colin Watson <email address hidden>  Mon, 09 May 2011 13:45:39 +0100

putty (0.60+2010-12-08-1) unstable; urgency=low
  * New experimental development snapshot.    - Add more possible baud rates to the Unix serial backend (closes:      #606328).  * Add ${misc:Depends}.  * Remove deprecated Encoding keys from desktop files.  * Remove deprecated Application categories from desktop files.  * Build with GSSAPI support (using run-time library binding). -- Colin Watson <email address hidden>  Wed, 08 Dec 2010 17:54:50 +0000

putty (0.60+2010-02-20-1) unstable; urgency=low


  * New experimental development snapshot.
    - Console utilities send prompts to /dev/tty or failing that stderr, not
      to stdout (closes: #422295).
  * Upgrade to debhelper v7.
  * Move documentation from putty-tools to a new putty-doc package (closes:
    #472195).
  * Add a watch file.
  * Convert to source format 3.0 (quilt).  No remaining Debian patches!

 -- Colin Watson <email address hidden>  Mon, 22 Feb 2010 01:01:22 +0000

putty (0.60+2009-11-22-1) unstable; urgency=low


  * New experimental development snapshot.
  * Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields.

 -- Colin Watson <email address hidden>  Fri, 01 Jan 2010 14:50:45 +0000

putty (0.60+2009-08-22-3) unstable; urgency=low


  * Use x11.pc when compiling/linking against GTK (closes: #556125).

 -- Colin Watson <email address hidden>  Mon, 23 Nov 2009 20:39:22 +0000