openSUSE-SU-2026:22127-1

This update for putty fixes the following issues:

Changes in putty:

• Update to release 0.85

  • Fixed a remotely triggerable use-after-free in Pageant.
  • Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.)
  • Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.)
  • Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimited memory at startup.

• Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short [boo#1266375, CVE-2026-48850]

• Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature [boo#1266373, CVE-2026-48852]

• Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing [boo#1266374, CVE-2026-48851]