[Secure-testing-team] Bug#719070: filezilla: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208

[Salvatore Bonaccorso]

Package: filezilla
Severity: grave
Tags: security upstream patch

Hi,

the following vulnerabilities were published for filezilla.

CVE-2013-4206[0]:
buffer underrun in modmul can corrupt the heap

CVE-2013-4207[1]:
non-coprime values in DSA signatures can cause buffer overflow in modular inverse

CVE-2013-4208[2]:
Private keys left in memory after being used by PuTTY tools

These three more CVEs are also fixed in newest upstream version of filezilla
(embedding putty source)[3].

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://security-tracker.debian.org/tracker/CVE-2013-4206
[1] http://security-tracker.debian.org/tracker/CVE-2013-4207
[2] http://security-tracker.debian.org/tracker/CVE-2013-4208
[3] https://filezilla-project.org/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore