CVSS: 4.3EPSS: 11%CPEs: 114EXPL: 0CVE-2008-2711 – fetchmail: Crash in large log messages in verbose mode
https://notcve.org/view.php?id=CVE-2008-2711
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages. fetchmail versión 6.3.8 y anteriores, cuando se ejecuta en modo -v -v (también se conoce como verbose), permite a los atacantes remotos causar una denegación de servicio (bloqueo y fallo de correo persistente) por medio de un mensaje de correo malformado con encabezados largos, lo que desencadena unas desreferencias erróneas cuando se utiliza vsnprintf para dar formato a mensajes de registro. • http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html http://secunia.com/advisories/30742 http://secunia.com/advisories/30895 http://secunia.com/advisories/31262 http://secunia.com/advisories/31287 http://secunia.com/advisories/33937 http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740 http://support.apple.com/kb/HT3438 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0235 http://www.fetchmail.info/fetchmail-SA-2008-01&# • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 5%CPEs: 115EXPL: 0CVE-2007-4565 – Fetchmail NULL pointer dereference
https://notcve.org/view.php?id=CVE-2007-4565
sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP. El archivo sink.c en fetchmail versiones anteriores a 6.3.9, permite a atacantes dependiendo del contexto causar una denegación de servicio (desreferencia del NULL y bloqueo de aplicación) al rechazar ciertos mensajes de advertencia que son enviados mediante SMTP. • http://fetchmail.berlios.de/fetchmail-SA-2007-02.txt http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html http://mknod.org/svn/fetchmail/branches/BRANCH_6-3/fetchmail-SA-2007-02.txt http://osvdb.org/45833 http://secunia.com/advisories/27399 http://secunia.com/advisories/33937 http://securityreason.com/securityalert/3074 http://support.apple.com/kb/HT3438 http://www.debian.org/securi • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 13%CPEs: 109EXPL: 0CVE-2006-5867 – fetchmail not enforcing TLS for POP3 properly
https://notcve.org/view.php?id=CVE-2006-5867
fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks. fetchmail anetrior a 6.3.6-rc4 no fuerza TLS adecuadamente y puede transmitir contraseñas en texto en claro sobre enlaces inseguros si se producen determinadas circunstancias, lo cual permite a atacantes remotos obtener información sensible mediante ataques de hombre-en-medio (man-in-the-middle o MITM). • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc http://docs.info.apple.com/article.html?artnum=305391 http://fedoranews.org/cms/node/2429 http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html http://osvdb.org/31580 http://secunia.com/advisories/23631 http://secunia.com/advisories/23695 http://secunia.com/advisories/23714 http://secunia.com/advisories/23781 http://secunia.com • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 4%CPEs: 89EXPL: 0CVE-2005-2335
https://notcve.org/view.php?id=CVE-2005-2335
Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier. • http://developer.berlios.de/project/shownotes.php?release_id=6617 http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html http://secunia.com/advisories/16176 http://secunia.com/advisories/21253 http://www.debian.org/security/2005/dsa-774 http://www.novell.com/linux/security/advisories/2005_18_sr.html http://www.osvdb.org/18174 http://www.redhat.com/archives/fedora-announce-list/2005-July/msg00088.html h • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 3%CPEs: 86EXPL: 0CVE-2003-0792
https://notcve.org/view.php?id=CVE-2003-0792
Fetchmail 6.2.4 and earlier does not properly allocate memory for long lines, which allows remote attackers to cause a denial of service (crash) via a certain email. Fetchmail 6.2.4 y anteriores no asigna memoria para lineas largas adecuadamente, lo que permite a atacantes remotos causar una denegación de servicio (caída) mediante cierto correo electrónico. • ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-004.0/CSSA-2004-004.0.txt http://marc.info/?l=bugtraq&m=107731542827401&w=2 http://security.gentoo.org/glsa/glsa-200403-10.xml http://www.mandriva.com/security/advisories?name=MDKSA-2003:101 http://www.securityfocus.com/advisories/5987 http://www.securityfocus.com/bid/8843 http://www.turbolinux.com/security/TLSA-2003-61.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/13450 • CWE-399: Resource Management Errors •