CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Fetchmail » Fetchmail : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-3482 DoS +Info 2012-12-21 2013-04-04
5.8
None Remote Medium Not required Partial None Partial
Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.
2 CVE-2011-1947 399 DoS 2011-06-02 2011-09-06
5.0
None Remote Low Not required None None Partial
fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging the request but not sending additional packets.
3 CVE-2010-1167 20 DoS 2010-05-07 2011-08-26
4.3
None Remote Medium Not required None None Partial
fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3 UIDL list.
4 CVE-2010-0562 119 DoS Exec Code Overflow 2010-02-08 2011-04-27
6.8
None Remote Medium Not required Partial Partial Partial
The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping.
5 CVE-2009-2666 310 2009-08-07 2011-02-15
6.4
None Remote Low Not required Partial Partial None
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
6 CVE-2008-2711 20 DoS 2008-06-16 2011-02-15
4.3
None Remote Medium Not required None None Partial
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
7 CVE-2007-4565 DoS 2007-08-27 2011-02-15
5.0
None Remote Low Not required None None Partial
sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.
8 CVE-2006-5974 20 DoS 2006-12-31 2011-02-15
7.8
None Remote Low Not required None None Complete
fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.
9 CVE-2006-5867 20 +Info 2006-12-31 2013-07-04
7.8
None Remote Low Not required Complete None None
fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.
10 CVE-2006-0321 20 DoS 2006-01-23 2011-02-15
5.0
None Remote Low Not required None None Partial
fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.
11 CVE-2005-4348 399 DoS 2005-12-20 2011-02-15
7.8
None Remote Low Not required None None Complete
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
12 CVE-2005-3088 200 +Info 2005-10-27 2011-02-15
2.1
None Local Low Not required Partial None None
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords.
13 CVE-2005-2335 119 DoS Exec Code Overflow 2005-07-27 2011-02-15
5.0
None Remote Low Not required None None Partial
Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.
14 CVE-2003-0792 399 DoS 2003-11-17 2011-02-15
5.0
None Remote Low Not required None None Partial
Fetchmail 6.2.4 and earlier does not properly allocate memory for long lines, which allows remote attackers to cause a denial of service (crash) via a certain email.
15 CVE-2002-1365 119 Exec Code Overflow 2002-12-23 2011-02-15
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
16 CVE-2002-1175 20 DoS 2002-10-11 2011-02-15
5.0
None Remote Low Not required None None Partial
The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.
17 CVE-2002-1174 119 DoS Exec Code Overflow 2002-10-11 2011-02-15
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.
18 CVE-2002-0146 20 2002-06-25 2011-02-15
5.0
None Remote Low Not required Partial None None
fetchmail email client before 5.9.10 does not properly limit the maximum number of messages available, which allows a remote IMAP server to overwrite memory via a message count that exceeds the boundaries of an array.
19 CVE-2001-1378 59 2001-09-06 2011-02-16
2.1
None Local Low Not required None Partial None
fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files.
20 CVE-2001-1009 264 +Priv 2001-08-31 2011-02-16
10.0
Admin Remote Low Not required Complete Complete Complete
Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request.
21 CVE-2001-0819 119 Exec Code Overflow 2001-12-06 2011-02-15
7.5
None Remote Low Not required Partial Partial Partial
A buffer overflow in Linux fetchmail before 5.8.6 allows remote attackers to execute arbitrary code via a large 'To:' field in an email header.
22 CVE-2001-0101 2001-02-12 2011-02-16
10.0
None Remote Low Not required Complete Complete Complete
Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command.
Total number of vulnerabilities : 22   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.