Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter, which leads to a buffer overflow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Putty | Putty | 0.48 (including) | 0.48 (including) |
| Putty | Putty | 0.49 (including) | 0.49 (including) |
| Putty | Putty | 0.50 (including) | 0.50 (including) |
| Putty | Putty | 0.51 (including) | 0.51 (including) |
| Putty | Putty | 0.52 (including) | 0.52 (including) |
| Putty | Putty | 0.53 (including) | 0.53 (including) |
| Putty | Putty | 0.53b (including) | 0.53b (including) |
| Putty | Putty | 0.54 (including) | 0.54 (including) |
| Putty | Putty | 0.55 (including) | 0.55 (including) |
| Tortoisecvs | Tortoisecvs | 1.8 (including) | 1.8 (including) |