CVE-2019-9896

Upstream information

CVE-2019-9896 at MITRE

Description

In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	4.6
Vector	AV:L/AC:L/Au:N/C:P/I:P/A:P
Access Vector	Local
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores

	National Vulnerability Database
Base Score	7.8
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Access Vector	Local
Access Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entry: 1129633 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2019:1113-1, published Tue, 2 Apr 2019 18:15:40 +0200 (CEST)
• openSUSE-SU-2019:1123-1, published Tue, 2 Apr 2019 21:09:57 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub for SUSE Linux Enterprise 15	putty >= 0.71-bp150.4.3.1	Patchnames: openSUSE-2019-1123
openSUSE Leap 15.0	putty >= 0.71-lp150.9.1 putty-debuginfo >= 0.71-lp150.9.1 putty-debugsource >= 0.71-lp150.9.1	Patchnames: openSUSE-2019-1113