Critical severity9.8NVD Advisory· Published Mar 27, 2017· Updated May 13, 2026

CVE-2017-6542

Description

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.

Affected products

Putty/Putty
cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*
Range: <=0.67
OpenSUSE/Leap2 versions
cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse_project:leap:42.1:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.htmlnvdPatchVendor Advisory
lists.opensuse.org/opensuse-updates/2017-03/msg00055.htmlnvdThird Party Advisory
www.securityfocus.com/bid/97156nvdThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/201703-03nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1038067nvd
security.gentoo.org/glsa/201706-09nvd
www.exploit-db.com/exploits/42137/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.018
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000