+++ This bug was initially created as a clone of Bug #17114 +++ Upstream has issued an advisory on November 7: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html The issue is fixed upstream in version 0.66. FileZilla embeds a copy of PuTTY and needs to be updated once FileZilla has been updated to include PuTTY 0.66. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5309 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html https://filezilla-project.org/newsfeed.php
@ David: I just asked upstream to irc channel and they say: david_david: - from http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html: "Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do not include the terminal emulator, so cannot be exploited this way." - SFTP support in FileZilla is based on PuTTY's psftp So seems that filezilla package is not affected by CVE-2015-5309.
OK, thanks.
Status: NEW => RESOLVEDResolution: (none) => INVALID