CVE-2016-2563
Critical · 9.8CVSS
9.8
EPSS
32.8%
Published
Apr 7, 2016
CISA due date
—
The record
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | putty | 0 | 0.67-1 |
| Debian:12 | putty | 0 | 0.67-1 |
| Debian:13 | putty | 0 | 0.67-1 |
| Mageia:5 | filezilla | 0 | 3.16.1-1.mga5 |
| Mageia:5 | halibut | 0 | 1.1-2.mga5 |
| Mageia:5 | libfilezilla | 0 | 0.4.0.1-1.mga5 |
| Mageia:5 | pugixml | 0 | 1.7-1.mga5 |
| Mageia:5 | putty | 0 | 0.67-1.mga5 |
| Ubuntu:16.04:LTS | putty | 0 | 0.67-1 |
Related vulnerabilities
- CVE-2017-6542 The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have… Also affects putty
- CVE-2015-4000 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server… Also affects filezilla
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. CWE-119