CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use...
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
CVE-2013-4852- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
CVE-2013-4852- Updated
- 2026-11-02
EUVDEUVD-2013-4697 No score
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
EUVD-2013-4697- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x52x-v8xm-9r9j No score
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use...
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
GHSA-x52x-v8xm-9r9j- Updated
- 2026-11-02
OSV No score
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
CVE-2013-4852- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4852 No score
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2013-4852- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2013-0242 No score
Updated putty and filezilla packages fixes security vulnerability
PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication, caused by improper bounds checking of the length parameter received from the SSH server. This allows remote attackers to cause denial of service, and may have more severe impact on the operation of software that uses PuTTY code (CVE-2013-4852).
PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to a heap-corrupting buffer underrun bug in the modmul function which performs modular multiplication (CVE-2013-4206).
PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to a buffer overflow vulnerability in the calculation of modular inverses when verifying a DSA signature (CVE-2013-4207).
PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to private keys left in memory after being used by PuTTY tools (CVE-2013-4208).
- Record
MGASA-2013-0242- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10374-1 No score
putty-0.67-1.5 on GA media
These are all security issues fixed in the putty-0.67-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10374-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10399-1 No score
filezilla-3.23.0.2-1.1 on GA media
These are all security issues fixed in the filezilla-3.23.0.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10399-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4852 No score
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
- Record
UBUNTU-CVE-2013-4852- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
filezillaDebian:12 |
before 3.7.3-1 | 3.7.3-1 |
filezillaDebian:13 |
before 3.7.3-1 | 3.7.3-1 |
filezillaDebian:14 |
before 3.7.3-1 | 3.7.3-1 |
puttyDebian:12 |
before 0.63-1 | 0.63-1 |
puttyDebian:13 |
before 0.63-1 | 0.63-1 |
puttyDebian:14 |
before 0.63-1 | 0.63-1 |
puttyDebian:6.0 |
before 0.60+2010-02-20-1+squeeze2, plus listed versions 0.60+2010-02-20-10.60+2010-02-20-1+squeeze1 |
0.60+2010-02-20-1+squeeze2 |
puttyDebian:7 |
before 0.62-9+deb7u1, plus listed versions 0.62-9 |
0.62-9+deb7u1 |
puttyMageia:2 |
before 0.63-1.mga2 | 0.63-1.mga2 |
filezillaMageia:2 |
before 3.7.3-1.mga2 | 3.7.3-1.mga2 |
Show 5 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4852 is a medium vulnerability (CVSS 6.8) in Putty, published August 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.45%, the 89th percentile. Fixed in filezilla 3.7.3-1.
References
secunia.com/advisories/54533
winscp.net/tracker/show_bug.cgi?id=1017
bugs.debian.org/cgi-bin/bugreport.cgi?bug=718779
search-lab.hu/advisories/secadv-20130722
debian.org/security/2013/dsa-2736
Show 23 moreShow less
svn.tartarus.org/sgt?view=revision&sortby=date&revision=9896
lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html
nvd.nist.gov/vuln/detail/CVE-2013-4852
github.com/advisories/GHSA-x52x-v8xm-9r9j
security-tracker.debian.org/tracker/CVE-2013-4852
advisories.mageia.org/MGASA-2013-0242.html
bugs.mageia.org/show_bug.cgi?id=10925
openwall.com/lists/oss-security/2013/08/06/13
ubuntu.com/security/CVE-2013-4852
securityfocus.com/archive/1/527763/30/0
cve.org/CVERecord?id=CVE-2013-4852
suse.com/security/cve/CVE-2013-4852