CVE-2013-4206
PuTTY < 0.63 - Heap-Based Buffer Underflow via Crafted DSA Signature
Title source: llmDescription
Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) and possibly trigger memory corruption or code execution via a crafted DSA signature, which is not properly handled when performing certain bit-shifting operations during modular multiplication.
References (7)
Core 7
Core References
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/08/06/11
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/54533
Vendor Advisory x_refsource_confirm
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2013/dsa-2736
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/54379
Patch x_refsource_confirm
http://svn.tartarus.org/sgt/putty/sshbn.c?sortby=date&r1=9977&r2=9976&pathrev=9977
Scores
EPSS
0.0248
EPSS Percentile
82.7%
Details
CWE
CWE-119
Status
published
Products (20)
putty/putty
0.45
putty/putty
0.46
putty/putty
0.47
putty/putty
0.48
putty/putty
0.49
putty/putty
0.50
putty/putty
0.51
putty/putty
0.52
putty/putty
0.53b
putty/putty
0.54
... and 10 more
Published
Aug 19, 2013
Tracked Since
Feb 18, 2026