CVE-2013-1762

Severity: medium (CVSS 6.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-03-08 · updated 2026-06-16
Weakness: CWE-94

Description

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

Affected products

stunnel: through 4.54; 4.21, 4.22, 4.23, 4.24, 4.25, 4.26 (+27)

References

http://rhn.redhat.com/errata/RHSA-2013-0714.html
http://www.debian.org/security/2013/dsa-2664
http://www.mandriva.com/security/advisories?name=MDVSA-2013:130
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097
https://www.stunnel.org/CVE-2013-1762.html
http://rhn.redhat.com/errata/RHSA-2013-0714.html
http://www.debian.org/security/2013/dsa-2664
http://www.mandriva.com/security/advisories?name=MDVSA-2013:130
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097
https://www.stunnel.org/CVE-2013-1762.html

Get alerted when CVE-2013-1762 or the next vulnerability affects your stack