CVE-2013-1762

published 2013-03-08

CVE-2013-1762: stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows…

Priority P3 38 medium 6.6 CVSS 2.0

AV N AC H Au N C P I P A C

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

Affected

35 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	stunnel4	< stunnel4 3:4.53-1.1 (bookworm)	stunnel4 3:4.53-1.1 (bookworm)
stunnel	stunnel	<= 4.54	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—

CVSS provenance

nvd v2.0 6.6 MEDIUM AV:N/AC:H/Au:N/C:P/I:P/A:C

osv 6.6 MEDIUM

vendor_debian 6.6 MEDIUM

vendor_redhat 6.6 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94