When PuTTY has sensitive data in memory and has no further need for
it, it should wipe the data out of its memory, in case malware later
gains access to the PuTTY process or the memory is swapped out to
disk or written into a crash dump file. An obvious example of this
is the password typed during SSH login; other examples include
obsolete session keys, public-key passphrases, and the private
halves of public keys.
PuTTY 0.63 and earlier versions, after loading a private key
from a disk file, mistakenly leak a memory buffer containing a
copy of the private key, in the function ssh2_load_userkey. The
companion function ssh2_save_userkey (only called by PuTTYgen) can
also leak a copy, but only in the case where the file it tried to
save to could not be created.