Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2011-1947

fetchmail: Application hang due unguarded blocking I/O in IMAP/POP3 STARTTLS initialization (fetchmail-SA-2011-01)

fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging the request but not sending additional packets.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Fetchmail
Products
Fetchmail
CVE-2010-0562

fetchmail: (verbose mode) Heap overflow by formating byte string into its printable representation

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed
Vendors
Fetchmail
Products
Fetchmail
CVE-2012-3482

fetchmail: DoS (crash) in the base64 decoder upon server NTLM protocol exchange abort right after the initial request

Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.

CVSS 2.0 · 5.8 Medium EPSS 1.9% KEV · Not listed
Vendors
Fetchmail
Products
Fetchmail
CVE-2021-36386

fetchmail: DoS or information disclosure when logging long messages

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Fetchmail Redhat
Products
Fedora Fetchmail Enterprise Linux