PuTTY -- Four security holes in versions before 0.63

Simon Tatham reports:

This [0.63] release fixes multiple security holes in previous versions of
PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
underrun buffers and crash. […]

    These vulnerabilities can be triggered before host key verification,
    which means that you are not even safe if you trust the server you
    think you're connecting to, since it could be spoofed over the
    network and the host key check would not detect this before the attack
    could take place.
  
    Additionally, when PuTTY authenticated with a user's private key, the
    private key or information equivalent to it was accidentally kept in
    PuTTY's memory for the rest of its run, where it could be retrieved by
    other processes reading PuTTY's memory, or written out to swap files
    or crash dumps. This release fixes that as well.