Bug 1279425 (CVE-2015-5309)

A potentially memory-corrupting integer overflow in the handling of ECH (erase characters) control sequence in the terminal emulator was found in putty versions between 0.54 and 0.65. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server the victim is connecting to. For instance, an attacker on a multi-user machine that you connect to could trick victim into running cat on a file they control containing a malicious escape sequence.
The vulnerability arises because PuTTY uses signed integer variables to hold the number of characters to be erased and doesn't adequately check for overflow. This means that by passing a very large parameter to ECH, an attacker could cause check_boundary to inspect memory outside the terminal buffer. Were it to find UCSWIDE there, it would corrupt some nearby memory. This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure. 

Upstream patch:

http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commit;h=6056396f77cafc7e40da4d09f1d6212408dcb065

External reference:

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html