6.6

CVE-2013-1762

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Stunnel ≫ Stunnel Version <= 4.54
Stunnel ≫ Stunnel Version 4.21
Stunnel ≫ Stunnel Version 4.22
Stunnel ≫ Stunnel Version 4.23
Stunnel ≫ Stunnel Version 4.24
Stunnel ≫ Stunnel Version 4.25
Stunnel ≫ Stunnel Version 4.26
Stunnel ≫ Stunnel Version 4.27
Stunnel ≫ Stunnel Version 4.28
Stunnel ≫ Stunnel Version 4.29
Stunnel ≫ Stunnel Version 4.30
Stunnel ≫ Stunnel Version 4.31
Stunnel ≫ Stunnel Version 4.32
Stunnel ≫ Stunnel Version 4.33
Stunnel ≫ Stunnel Version 4.34
Stunnel ≫ Stunnel Version 4.35
Stunnel ≫ Stunnel Version 4.36
Stunnel ≫ Stunnel Version 4.37
Stunnel ≫ Stunnel Version 4.38
Stunnel ≫ Stunnel Version 4.39
Stunnel ≫ Stunnel Version 4.40
Stunnel ≫ Stunnel Version 4.41
Stunnel ≫ Stunnel Version 4.42
Stunnel ≫ Stunnel Version 4.43
Stunnel ≫ Stunnel Version 4.44
Stunnel ≫ Stunnel Version 4.45
Stunnel ≫ Stunnel Version 4.46
Stunnel ≫ Stunnel Version 4.47
Stunnel ≫ Stunnel Version 4.48
Stunnel ≫ Stunnel Version 4.49
Stunnel ≫ Stunnel Version 4.50
Stunnel ≫ Stunnel Version 4.51
Stunnel ≫ Stunnel Version 4.52
Stunnel ≫ Stunnel Version 4.53
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.93% 0.853
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.6 4.9 8.5
AV:N/AC:H/Au:N/C:P/I:P/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://rhn.redhat.com/errata/RHSA-2013-0714.html
http://www.debian.org/security/2013/dsa-2664
http://www.mandriva.com/security/advisories?name=MDVSA-2013:130
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097
https://www.stunnel.org/CVE-2013-1762.html
Vendor Advisory