Lucene search

PRIOn knowledge basePRION:CVE-2013-4208

HistoryAug 19, 2013 - 11:55 p.m.

Use after free

2013-08-1923:55:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.

CPENameOperatorVersion
puttyeq0.50
puttyeq0.49
puttyeq0.51
puttyeq0.55
puttyeq0.53.98
puttyeq0.52
puttyeq0.48
puttyeq0.54
puttyeq0.45
puttyeq0.46

Name	Operator	Version
putty	eq	0.50
putty	eq	0.49
putty	eq	0.51
putty	eq	0.55
putty	eq	0.53.98
putty	eq	0.52
putty	eq	0.48
putty	eq	0.54
putty	eq	0.45
putty	eq	0.46

Rows per page:

1-10 of 191

References

lists.opensuse.org/opensuse-updates/2013-08/msg00035.html

secunia.com/advisories/54379

secunia.com/advisories/54533

www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html

www.debian.org/security/2013/dsa-2736

www.openwall.com/lists/oss-security/2013/08/06/11