CVE-2015-2157: Debian Linux

Low severity, CVSS 2.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.

Affected products

• Debian Debian Linux: version 7.0 only
• Fedoraproject Fedora: version 20 only; version 22 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Putty Putty: version 0.51 only; version 0.52 only; version 0.53b only; version 0.54 only; version 0.55 only; version 0.56 only; …
• Simon Tatham Putty: version 0.53 only

Published 2015-03-27. Last modified 2026-06-17.