CVE-2013-1762

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

Published: Mar 8, 2013
Updated: Apr 13, 2023
CVE: CVE-2013-1762
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.6
AV:N/AC:H/Au:N/C:P/I:P/A:C

CWEs:

CWE-94

Affected Software
References

Software	From	Fixed in
stunnel / stunnel	4.21	4.21.x
stunnel / stunnel	4.51	4.51.x
stunnel / stunnel	4.45	4.45.x
stunnel / stunnel	4.52	4.52.x
stunnel / stunnel	4.40	4.40.x
stunnel / stunnel	4.32	4.32.x
stunnel / stunnel	-	4.54.x
stunnel / stunnel	4.33	4.33.x
stunnel / stunnel	4.48	4.48.x
stunnel / stunnel	4.31	4.31.x
stunnel / stunnel	4.37	4.37.x
stunnel / stunnel	4.38	4.38.x
stunnel / stunnel	4.50	4.50.x
stunnel / stunnel	4.47	4.47.x
stunnel / stunnel	4.22	4.22.x
stunnel / stunnel	4.42	4.42.x
stunnel / stunnel	4.53	4.53.x
stunnel / stunnel	4.39	4.39.x
stunnel / stunnel	4.24	4.24.x
stunnel / stunnel	4.27	4.27.x
stunnel / stunnel	4.41	4.41.x
stunnel / stunnel	4.44	4.44.x
stunnel / stunnel	4.28	4.28.x
stunnel / stunnel	4.43	4.43.x
stunnel / stunnel	4.34	4.34.x
stunnel / stunnel	4.29	4.29.x
stunnel / stunnel	4.36	4.36.x
stunnel / stunnel	4.23	4.23.x
stunnel / stunnel	4.46	4.46.x
stunnel / stunnel	4.26	4.26.x
stunnel / stunnel	4.30	4.30.x
stunnel / stunnel	4.25	4.25.x
stunnel / stunnel	4.49	4.49.x
stunnel / stunnel	4.35	4.35.x

Vulnerability Database

289,599

CVE-2013-1762