← Back

CVE-2013-4208

nvd nist
Published: Aug 19, 2013Modified: Apr 29, 2026

JSON object

Loading...
2.1
Vector
AV:L/AC:L/Au:N/C:P/I:N/A:N
Exploitability: 3.9 / Impact: 2.9
Source: NVD

Description

The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.

Affected (19)

Products: Putty: Putty · Simon Tatham: Putty
Putty
1 product
Putty
Simon Tatham
1 product
Putty
Configuration A
19 vulnerable
Vulnerable SoftwareAffected Versions
Putty
Putty
Version 0.45
Putty
Version 0.46
Putty
Version 0.47
Putty
Version 0.48
Putty
Version 0.49
Putty
Version 0.50
Putty
Version 0.51
Putty
Version 0.52
Putty
Version 0.53b
Putty
Version 0.54
Putty
Version 0.55
Putty
Version 0.56
Putty
Version 0.57
Putty
Version 0.58
Putty
Version 0.59
Putty
Version 0.60
Putty
Version 0.61
Simon Tatham
Putty
Up to 0.62
Putty
Version 0.53

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

Source: secalert@redhat.com
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.