CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2019-9898
https://notcve.org/view.php?id=CVE-2019-9898
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. Existe el reciclado potencial de números aleatorios empleados en criptografía en PuTTY, en versiones anteriores a la 0.71. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.html http://www.securityfocus.com/bid/107523 https://lists.debian.org/debian-lts-announce/2019/04/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES https://seclists.org&#x • CWE-330: Use of Insufficiently Random Values •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2019-9897
https://notcve.org/view.php?id=CVE-2019-9897
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71. Existen múltiples ataques de denegación de servicio (DoS) que pueden desencadenarse escribiendo en la terminal en PuTTY, en versiones anteriores a la 0.71. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.html https://lists.debian.org/debian-lts-announce/2019/04/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES https://seclists.org/bugtraq/2019/Apr/6 https://security. •
CVSS: 9.8EPSS: 2%CPEs: 4EXPL: 0CVE-2019-9895
https://notcve.org/view.php?id=CVE-2019-9895
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding. En PuTTY, en versiones anteriores a la 0.71 en Unix, existe un desbordamiento de búfer desencadenable remotamente en cualquier tipo de redirección servidor-a-cliente. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES https://seclists.org/bugtraq/2019/Apr/6 https://security.netapp.com/advisory/ntap-20190404-0001 https://www.chiark.greenend.org • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 2%CPEs: 7EXPL: 0CVE-2019-9894
https://notcve.org/view.php?id=CVE-2019-9894
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification. Puede ocurrir una sobrescritura de memoria desencadenable remotamente en el intercambio de claves RSA en PuTTY, en versiones anteriores a la 0.71, antes de la verificación de claves del host. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.html https://lists.debian.org/debian-lts-announce/2019/04/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES https://seclists.org/bugtraq/2019/Apr/6 https://security. • CWE-320: Key Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2019-3856 – libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write
https://notcve.org/view.php?id=CVE-2019-3856
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Se ha descubierto un error de desbordamiento de enteros que podría conducir a una escritura fuera de límites en libssh2, en versiones anteriores a la 1.8.1, en la forma en la que se analizan las peticiones de comandos de teclado. Un atacante remoto que comprometa un servidor SSH podría ser capaz de ejecutar código en el sistema del cliente cuando un usuario se conecta al servidor. An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 in the way keyboard prompt requests are parsed. • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html https://access.redhat.com/errata/RHSA-2019:0679 https://access.redhat.com/errata/RHSA-2019:1175 https://access.redhat.com/errata/RHSA-2019:1652 https://access.redhat.com/errata/RHSA-2019:1791 https://access.redhat.com/errata/RHSA-2019:1943 https://access.redhat.com/errata/RHSA-2019:2399 https://bugzilla.redhat.com/show_bug.cgi?id&# • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •