CVE-2015-5309 — Out-of-bounds Write in Tatham Putty

CWE-1899 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
1.7%
top 17.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PuttySimon Tatham PuttyOpensuse Leap+1 more
Timeline
PublishedDec 7
Latest updateMay 14

Description

Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer underflow.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶Debianputty/putty< 0.66-1+3
▶NVDopensuse/leap42.1
▶NVDopensuse/opensuse13.1, 13.2+1

🔴Vulnerability Details

3
GHSA
GHSA-xf6h-8pvx-cg8q: Integer overflow in the terminal emulator in PuTTY before 0↗2022-05-14
▶
CVEList
CVE-2015-5309: Integer overflow in the terminal emulator in PuTTY before 0↗2015-12-07
▶
OSV
CVE-2015-5309: Integer overflow in the terminal emulator in PuTTY before 0↗2015-12-07
▶

📋Vendor Advisories

1
Debian
CVE-2015-5309: putty - Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote att...↗2015
▶

💬Community

4
Bugzilla
CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling [epel-5]↗2015-11-09
▶
Bugzilla
CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling [fedora-all]↗2015-11-09
▶
Bugzilla
CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling [epel-6]↗2015-11-09
▶
Bugzilla
CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling↗2015-11-09
▶
CVE-2015-5309 — Out-of-bounds Write in Tatham Putty | cvebase