CVE-2013-4208

Name	CVE-2013-4208
Description	The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2736-1
Debian Bugs	719070

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
filezilla (PTS)	buster	3.39.0-2+deb10u1	fixed
	bullseye	3.52.2-3	fixed
	bookworm	3.63.0-1+deb12u2	fixed
	trixie	3.66.1-2	fixed
	sid	3.66.1-3.2	fixed
putty (PTS)	buster	0.70-6	fixed
	bullseye	0.74-1	fixed
	bookworm	0.78-2	fixed
	sid, trixie	0.79-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
filezilla	source	(unstable)	3.7.3-1	low		719070
putty	source	squeeze	0.60+2010-02-20-1+squeeze2		DSA-2736-1
putty	source	wheezy	0.62-9+deb7u1		DSA-2736-1
putty	source	(unstable)	0.63-1

Notes

[squeeze] - filezilla <no-dsa> (Minor issue)
[wheezy] - filezilla <no-dsa> (Minor issue)
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html