Differences
This shows you the differences between the selected revisions of the page.
| history 2026-10-15 | history 2026-11-11 (current) | ||
| Line 3: | Line 3: | ||
| This is a full list of changes for each release of WinSCP. See also [[project_history|Project history]] and [[incompatible_changes|Incompatible changes between versions]]. | This is a full list of changes for each release of WinSCP. See also [[project_history|Project history]] and [[incompatible_changes|Incompatible changes between versions]]. | ||
| - | ===== [[6.8]] 6.8 (not released yet) ((2026-08-22)) ===== | + | ===== [[6.8]] 6.8 (not released yet) ((2026-11-06)) ===== |
| * Word wrapping in the internal editor can be toggled from toolbar menu. [[bug>2451]] | * Word wrapping in the internal editor can be toggled from toolbar menu. [[bug>2451]] | ||
| + | * Support client certificates with intermediate certificate. [[bug>2475]] | ||
| + | * Allow opening file properties from S3 servers that keep no object ACLs. [[bug>2472]] | ||
| + | * Not loading S3 tags for directories to avoid errors when opening directory Properties from servers that do not implement directory tags. [[bug>2473]] | ||
| + | * Bug fix: Failure when SSH authentication banner is displayed while reconnecting a session. [[bug>2474]] | ||
| + | * Bug fix: Parsing of multiline VMS FTP listing entries is broken. [[bug>1950]] | ||
| + | * Bug fix: Dragging file from long path directory to remote panel results in uploading the file with 8.3 filename. [[bug>2480]] | ||
| + | * Bug fix: Ampersand in group box caption is duplicated in preferences search results. | ||
| + | * Bug fix: Failure when system fails to provide timezone information for specific year. [[bug>2481]] | ||
| + | |||
| + | ===== [[6.7.1]] 6.7.1 ((2026-11-11)) ===== | ||
| + | |||
| + | * Translations completed: Bulgarian, and updated: Brazilian Portuguese. | ||
| + | * XML parser upgraded to Expat 2.10.0. | ||
| + | * Installer upgraded to Inno Setup 6.7.4. | ||
| + | * Security fix: Prevent loading PuTTY and custom GSS library settings that can lead to remote code execution from handled URLs. [[bug>2485]] | ||
| + | * Bug fix: Memory leak in encrypted HTTP/S3/WebDAV connections. [[bug>2476]] | ||
| + | * Bug fix: Recursive SCP directory download allows local path traversal when replacing of invalid characters in filenames is disabled. [[bug>2477]] | ||
| + | * Bug fix: Failure when dragging remote file with drag&drop shell extension enabled in 64-bit build. [[bug>2478]] | ||
| + | * Bug fix: Failure when showing a message box on a system that does not support annotating accessible elements. [[bug>2482]] | ||
| + | * Bug fix: Remote file Properties unreadable with themes disabled. [[bug>2483]] | ||
| + | * Bug fix: Failure when showing a message box and its accessibility interface is requested too early. [[bug>2484]] | ||
| ===== [[6.7]] 6.7 ((2026-10-14)) ===== | ===== [[6.7]] 6.7 ((2026-10-14)) ===== | ||
| Line 193: | Line 214: | ||
| * Bug fix: Cannot install from Microsoft Store because of invalid 'sr' language. [[bug>2460]] | * Bug fix: Cannot install from Microsoft Store because of invalid 'sr' language. [[bug>2460]] | ||
| - | gjug | + | ===== [[6.5.7]] 6.5.7 ((2026-09-09)) ===== |
| + | |||
| + | * Translations completed: Croatian, Finnish, Georgian, Italian and Serbian, and updated: Slovenian. | ||
| + | * TLS/SSL core upgraded to OpenSSL 3.3.7. | ||
| + | * SSH private key tools (PuTTYgen and Pageant) upgraded to [[&url(puttychanges)|PuTTY 0.85]]. SSH core upgraded to include some fixes. \\ It brings the following change: | ||
| + | * Security issue: fixed a remotely triggerable use-after-free in Pageant. [[pbug>pageant-deferred-decryption-uaf]] | ||
| + | * Security issue: fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. [[pbug>etm-large-packet-overflow]] | ||
| + | * Security issue: fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. [[pbug>argon2-parameter-checks]] | ||
| + | * Denial-of-service security fixes: a server can trigger a tight loop in WinSCP, and even a MITM can make it consume unlimited memory at startup. [[pbug>maxpkt-0-tight-loop]] | ||
| + | * Security issue: fixed a remotely triggerable double-free in RSA key exchange. [[pbug>rsakex-double-free]] | ||
| + | * Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. [[pbug>ecdsa-remotely-triggerable-assertion]] | ||
| + | * Back-propagated fixes from 6.6.2 beta release: | ||
| + | * Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. [[bug>2441]] | ||
| + | * Bug fix: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. CVE-2026-45447 fix from OpenSSL 3.4.6. | ||
| ===== [[6.5.6]] 6.5.6 ((2026-03-25)) ===== | ===== [[6.5.6]] 6.5.6 ((2026-03-25)) ===== | ||
| Line 211: | Line 245: | ||
| * Bug fix: Failure when opening site imported from PuTTY with unsupported SSH proxy. [[bug>2407]] | * Bug fix: Failure when opening site imported from PuTTY with unsupported SSH proxy. [[bug>2407]] | ||
| * Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. [[bug>2409]] | * Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. [[bug>2409]] | ||
| - | |||
| - | ===== [[6.5.4]] 6.5.4 ((2025-10-16)) ===== | ||
| - | |||
| - | * Translations updated: Belarusian and Georgian. | ||
| - | * TLS/SSL core upgraded to OpenSSL 3.3.5. | ||
| - | * XML parser upgraded to Expat 2.7.3. | ||
| - | * Added new ''ap-southeast-6'' AWS region. | ||
| - | * Bug fix: When restored after operation completed while minimized the window is disabled. [[bug>2393]] | ||
| - | * Bug fix: Command ''md5sums'' is incorrectly used to calculate MD5 checksum instead of ''md5sum''. [[bug>2392]] | ||
| - | * Bug fix: Incomplete FTP upload when the source stream/stdin reads less than requested. [[bug>2395]] | ||
| - | * Bug fix: ''Shift''-clicking //OK// button on Synchronization checklist window when synchronization in the background was not possible still closed the window. | ||
| - | * Bug fix: Failure after reloading file panel when number of files decreases. [[bug>2402]] | ||
| - | * Bug fix: Failure or silently missing headers when when S3 request headers were too long. | ||
| [[history_old|Older versions]] | [[history_old|Older versions]] | ||
| ~~NOTOC~~ | ~~NOTOC~~ | ||
| ~~ARCHIVE=history_old~~ | ~~ARCHIVE=history_old~~ | ||