{"id":"CVE-2013-4852","aliases":["DEBIAN-CVE-2013-4852","DSA-2736-1","EUVD-2013-4697","GHSA-x52x-v8xm-9r9j","MGASA-2013-0242","UBUNTU-CVE-2013-4852","openSUSE-SU-2024:10374-1","openSUSE-SU-2024:10399-1"],"status":"published","title":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use...","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03447,"percentile":0.89093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2013-08-09T17:38:37Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"filezilla","fixed_in":["3.7.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"filezilla","fixed_in":["3.7.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"filezilla","fixed_in":["3.7.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"putty","fixed_in":["0.63-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"putty","fixed_in":["0.63-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"putty","fixed_in":["0.63-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"putty","fixed_in":["0.63-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60+2010-02-20-1+squeeze2"}]}],"versions":["0.60+2010-02-20-1","0.60+2010-02-20-1+squeeze1"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62-9+deb7u1"}]}],"versions":["0.62-9"],"bundled":4},{"source":"osv","ecosystem":"Mageia:2","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-1.mga2"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:2","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1.mga2"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"putty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67-1.5"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"filezilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.23.0.2-1.1"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"putty","product":"putty"},{"vendor":"simon_tatham","product":"putty"},{"vendor":"winscp","product":"winscp"}],"references":[{"url":"http://secunia.com/advisories/54533","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/54517","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://winscp.net/tracker/show_bug.cgi?id=1017","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718779","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.search-lab.hu/advisories/secadv-20130722","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2013/dsa-2736","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://svn.tartarus.org/sgt?view=revision\u0026sortby=date\u0026revision=9896","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/54379","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-08/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4852"},{"url":"https://github.com/advisories/GHSA-x52x-v8xm-9r9j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4852","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0242.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10925","tags":["report"]},{"url":"http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html","tags":["web"]},{"url":"http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html","tags":["web"]},{"url":"http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/06/13","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4852","tags":["report"]},{"url":"http://www.securityfocus.com/archive/1/527763/30/0","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4852","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4208","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4852","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2013-08-19T23:00:00Z","modified":"2024-08-06T16:59:40.996Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4697","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2013-08-19T23:00:00Z","modified":"2024-08-06T16:59:40Z","updated_at":"2026-11-03T01:56:30.535587Z"}],"ghsa":[{"id":"GHSA-x52x-v8xm-9r9j","title":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use...","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2022-05-13T01:07:25Z","modified":"2023-02-01T05:03:06Z","updated_at":"2026-11-02T14:50:01.019018Z"}],"nvd":[{"id":"CVE-2013-4852","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2013-08-19T23:55:09.077Z","modified":"2026-06-16T23:58:00.033Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-4852","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2013-08-19T23:55:09Z","modified":"2026-04-16T06:18:38.809410112Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4852","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2013-08-19T23:55:09.077Z","modified":"2026-09-01T20:03:18.555290197Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2736-1","title":"putty - several","status":"published","published":"2013-08-11T00:00:00Z","modified":"2026-03-09T01:19:11.54204Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0242","title":"Updated putty and filezilla packages fixes security vulnerability","description":"PuTTY versions 0.62 and earlier - as well as all software that\nintegrates   these versions of PuTTY - are vulnerable to an integer\noverflow leading to heap overflow during the SSH handshake before\nauthentication, caused by improper bounds checking of the length\nparameter received from the SSH server. This allows remote attackers\nto cause denial of service, and may have more severe impact on the\noperation of software that uses PuTTY code (CVE-2013-4852).\n\nPuTTY versions 0.62 and earlier - as well as all software that\nintegrates these versions of PuTTY - are vulnerable to a heap-corrupting\nbuffer underrun bug in the modmul function which performs modular\nmultiplication (CVE-2013-4206).\n\nPuTTY versions 0.62 and earlier - as well as all software that\nintegrates these versions of PuTTY - are vulnerable to a buffer overflow\nvulnerability in the calculation of modular inverses when verifying a\nDSA signature (CVE-2013-4207).\n\nPuTTY versions 0.62 and earlier - as well as all software that\nintegrates these versions of PuTTY - are vulnerable to private keys left\nin memory after being used by PuTTY tools (CVE-2013-4208).\n","status":"published","published":"2013-08-09T17:38:37Z","modified":"2026-04-16T06:24:33.138505177Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10374-1","title":"putty-0.67-1.5 on GA media","description":"These are all security issues fixed in the putty-0.67-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:29:46.641984Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10399-1","title":"filezilla-3.23.0.2-1.1 on GA media","description":"These are all security issues fixed in the filezilla-3.23.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:14:28.376086Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2013-4852","description":"Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.","status":"published","published":"2013-08-19T23:55:00Z","modified":"2025-09-08T16:43:05Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}