CVE-2013-4208

2013-08-1923:55:08

Debian Security Bug Tracker

security-tracker.debian.org

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.

OSVersionArchitecturePackageVersionFilename
Debian12allfilezilla< 3.7.3-1filezilla_3.7.3-1_all.deb
Debian11allfilezilla< 3.7.3-1filezilla_3.7.3-1_all.deb
Debian999allfilezilla< 3.7.3-1filezilla_3.7.3-1_all.deb
Debian13allfilezilla< 3.7.3-1filezilla_3.7.3-1_all.deb
Debian12allputty< 0.63-1putty_0.63-1_all.deb
Debian11allputty< 0.63-1putty_0.63-1_all.deb
Debian999allputty< 0.63-1putty_0.63-1_all.deb
Debian13allputty< 0.63-1putty_0.63-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	filezilla	< 3.7.3-1	filezilla_3.7.3-1_all.deb
Debian	11	all	filezilla	< 3.7.3-1	filezilla_3.7.3-1_all.deb
Debian	999	all	filezilla	< 3.7.3-1	filezilla_3.7.3-1_all.deb
Debian	13	all	filezilla	< 3.7.3-1	filezilla_3.7.3-1_all.deb
Debian	12	all	putty	< 0.63-1	putty_0.63-1_all.deb
Debian	11	all	putty	< 0.63-1	putty_0.63-1_all.deb
Debian	999	all	putty	< 0.63-1	putty_0.63-1_all.deb
Debian	13	all	putty	< 0.63-1	putty_0.63-1_all.deb