Unrated severityNVD Advisory· Published Aug 19, 2013· Updated Apr 29, 2026
CVE-2013-4852
CVE-2013-4852
Description
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
Affected products
57cpe:2.3:a:putty:putty:0.45:*:*:*:*:*:*:*+ 19 more
- cpe:2.3:a:putty:putty:0.45:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.46:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.47:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.48:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.49:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.50:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.51:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.52:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.53b:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.54:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.55:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.56:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.57:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.58:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.59:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.60:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.61:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:2010-06-01:r8967:*:*:development_snapshot:*:*:*
- cpe:2.3:a:simon_tatham:putty:*:*:*:*:*:*:*:*range: <=0.62
- cpe:2.3:a:simon_tatham:putty:0.53:*:*:*:*:*:*:*
cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*+ 32 more
- cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*range: <=5.1.5
- cpe:2.3:a:winscp:winscp:3.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:3.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:3.8_beta:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.1:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.3:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.6:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.7:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.8:rc:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.9:rc:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.4:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
11- secunia.com/advisories/54379nvdVendor Advisory
- www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.htmlnvdVendor Advisory
- bugs.debian.org/cgi-bin/bugreport.cginvd
- lists.opensuse.org/opensuse-updates/2013-08/msg00035.htmlnvd
- lists.opensuse.org/opensuse-updates/2013-08/msg00041.htmlnvd
- secunia.com/advisories/54517nvd
- secunia.com/advisories/54533nvd
- svn.tartarus.org/sgtnvd
- winscp.net/tracker/show_bug.cginvd
- www.debian.org/security/2013/dsa-2736nvd
- www.search-lab.hu/advisories/secadv-20130722nvd
News mentions
0No linked articles in our index yet.