CVE-2013-4207

PuTTY < 0.63 - Denial of Service via DSA Signature Modular Inverse Overflow

Title source: llm
STIX 2.1

Description

Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a different vulnerability than CVE-2013-4206.

References (6)

Core 6
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/08/06/11
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54533
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2736
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54379

Scores

EPSS 0.0183
EPSS Percentile 76.4%

Details

CWE
CWE-119
Status published
Products (20)
putty/putty 0.45
putty/putty 0.46
putty/putty 0.47
putty/putty 0.48
putty/putty 0.49
putty/putty 0.50
putty/putty 0.51
putty/putty 0.52
putty/putty 0.53b
putty/putty 0.54
... and 10 more
Published Aug 19, 2013
Tracked Since Feb 18, 2026