CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Putty » Putty : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-36367 345 2021-07-09 2021-07-14
5.8
 None Remote Medium Not required Partial Partial None
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
2 CVE-2020-14002 203 +Info 2020-06-29 2022-05-03
4.3
 None Remote Medium Not required Partial None None
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
3 CVE-2019-17069 416 DoS 2019-10-01 2022-03-31
5.0
 None Remote Low Not required None None Partial
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
4 CVE-2019-17068 74 2019-10-01 2019-11-27
5.0
 None Remote Low Not required None Partial None
PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.
5 CVE-2019-9898 327 2019-03-21 2021-07-21
7.5
 None Remote Low Not required Partial Partial Partial
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
6 CVE-2019-9897 20 2019-03-21 2021-07-21
5.0
 None Remote Low Not required None None Partial
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.
7 CVE-2019-9894 320 2019-03-21 2019-04-26
6.4
 None Remote Low Not required None Partial Partial
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
8 CVE-2017-6542 119 Overflow 2017-03-27 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.
9 CVE-2016-6167 426 Exec Code 2017-01-30 2022-05-01
4.4
 None Local Medium Not required Partial Partial Partial
Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.
10 CVE-2015-2157 200 +Info 2015-03-27 2019-03-21
2.1
 None Local Low Not required Partial None None
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
11 CVE-2013-4852 189 DoS Exec Code Overflow 2013-08-19 2021-08-06
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
12 CVE-2013-4208 200 +Info 2013-08-19 2019-03-21
2.1
 None Local Low Not required Partial None None
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.
13 CVE-2013-4207 119 DoS Overflow 2013-08-19 2021-08-06
4.3
 None Remote Medium Not required None None Partial
Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a different vulnerability than CVE-2013-4206.
14 CVE-2013-4206 119 DoS Exec Code Overflow Mem. Corr. 2013-08-19 2021-08-06
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) and possibly trigger memory corruption or code execution via a crafted DSA signature, which is not properly handled when performing certain bit-shifting operations during modular multiplication.
15 CVE-2011-4607 119 Overflow 2013-08-23 2019-03-21
2.1
 None Local Low Not required Partial None None
PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to read login passwords by obtaining access to the process' memory.
16 CVE-2006-7162 2007-03-07 2008-09-05
1.9
 None Local Medium Not required Partial None None
PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs created by putty, which allows local users to gain sensitive information by reading these files.
17 CVE-2005-0467 Exec Code Overflow 2005-02-21 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.
18 CVE-2004-1440 DoS Exec Code Overflow 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote attackers to execute arbitrary code via an SSH2 packet with a base argument that is larger than the mod argument, which causes the modpow function to write memory before the beginning of its buffer, and (2) remote malicious servers to cause a denial of service (client crash) and possibly execute arbitrary code via a large bignum during authentication.
19 CVE-2004-1008 Exec Code Overflow 2005-01-10 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter, which leads to a buffer overflow.
20 CVE-2003-0069 Exec Code 2003-03-18 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
21 CVE-2003-0048 2003-02-19 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
22 CVE-2000-0476 DoS 2000-06-01 2008-09-10
5.0
 None Remote Low Not required None None Partial
xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized.
Total number of vulnerabilities : 22   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.