Simon G. Tatham reports:
Many versions of PuTTY prior to 0.68 have a heap-corrupting integer
overflow bug in the ssh_agent_channel_data function which processes
messages sent by remote SSH clients to a forwarded agent connection. [...]
This bug is only exploitable at all if you have enabled SSH
agent forwarding, which is turned off by default. Moreover, an
attacker able to exploit this bug would have to have already be able
to connect to the Unix-domain socket representing the forwarded
agent connection. Since any attacker with that capability would
necessarily already be able to generate signatures with your agent's
stored private keys, you should in normal circumstances be defended
against this vulnerability by the same precautions you and your
operating system were already taking to prevent untrusted people
from accessing your SSH agent.