CVE-2001-1009 Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as p...
HighCVSS 10.0
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fetchmail | <= 5.8.14 | No fix listed |
| fetchmail | = 4.5.1 | No fix listed |
| fetchmail | = 4.5.2 | No fix listed |
| fetchmail | = 4.5.3 | No fix listed |
| fetchmail | = 4.5.4 | No fix listed |
| fetchmail | = 4.5.5 | No fix listed |
| fetchmail | = 4.5.6 | No fix listed |
| fetchmail | = 4.5.7 | No fix listed |
| fetchmail | = 4.5.8 | No fix listed |
| fetchmail | = 4.6.0 | No fix listed |
| fetchmail | = 4.6.1 | No fix listed |
| fetchmail | = 4.6.2 | No fix listed |
| fetchmail | = 4.6.3 | No fix listed |
| fetchmail | = 4.6.4 | No fix listed |
| fetchmail | = 4.6.5 | No fix listed |
| fetchmail | = 4.6.6 | No fix listed |
| fetchmail | = 4.6.7 | No fix listed |
| fetchmail | = 4.6.8 | No fix listed |
| fetchmail | = 4.6.9 | No fix listed |
| fetchmail | = 4.7.0 | No fix listed |
| fetchmail | = 4.7.1 | No fix listed |
| fetchmail | = 4.7.2 | No fix listed |
| fetchmail | = 4.7.3 | No fix listed |
| fetchmail | = 4.7.4 | No fix listed |
| fetchmail | = 4.7.5 | No fix listed |
Show 46 more
| Product | Affected versions | Fixed in |
|---|---|---|
| fetchmail | = 4.7.6 | No fix listed |
| fetchmail | = 4.7.7 | No fix listed |
| fetchmail | = 5.0.0 | No fix listed |
| fetchmail | = 5.0.1 | No fix listed |
| fetchmail | = 5.0.2 | No fix listed |
| fetchmail | = 5.0.3 | No fix listed |
| fetchmail | = 5.0.4 | No fix listed |
| fetchmail | = 5.0.5 | No fix listed |
| fetchmail | = 5.0.6 | No fix listed |
| fetchmail | = 5.0.7 | No fix listed |
| fetchmail | = 5.0.8 | No fix listed |
| fetchmail | = 5.1.0 | No fix listed |
| fetchmail | = 5.1.4 | No fix listed |
| fetchmail | = 5.2.0 | No fix listed |
| fetchmail | = 5.2.1 | No fix listed |
| fetchmail | = 5.2.3 | No fix listed |
| fetchmail | = 5.2.4 | No fix listed |
| fetchmail | = 5.2.7 | No fix listed |
| fetchmail | = 5.2.8 | No fix listed |
| fetchmail | = 5.3.0 | No fix listed |
| fetchmail | = 5.3.1 | No fix listed |
| fetchmail | = 5.3.3 | No fix listed |
| fetchmail | = 5.3.8 | No fix listed |
| fetchmail | = 5.4.0 | No fix listed |
| fetchmail | = 5.4.3 | No fix listed |
| fetchmail | = 5.4.4 | No fix listed |
| fetchmail | = 5.4.5 | No fix listed |
| fetchmail | = 5.5.0 | No fix listed |
| fetchmail | = 5.5.2 | No fix listed |
| fetchmail | = 5.5.3 | No fix listed |
| fetchmail | = 5.5.5 | No fix listed |
| fetchmail | = 5.5.6 | No fix listed |
| fetchmail | = 5.6.0 | No fix listed |
| fetchmail | = 5.7.0 | No fix listed |
| fetchmail | = 5.7.2 | No fix listed |
| fetchmail | = 5.7.4 | No fix listed |
| fetchmail | = 5.8 | No fix listed |
| fetchmail | = 5.8.1 | No fix listed |
| fetchmail | = 5.8.2 | No fix listed |
| fetchmail | = 5.8.3 | No fix listed |
| fetchmail | = 5.8.4 | No fix listed |
| fetchmail | = 5.8.5 | No fix listed |
| fetchmail | = 5.8.6 | No fix listed |
| fetchmail | = 5.8.11 | No fix listed |
| fetchmail | = 5.8.13 | No fix listed |
| fetchmail | = 5.9.0 | No fix listed |
References
- 20010809 Fetchmail security advisory exploit mailing-list patch vendor-advisory
- CLA-2001:419 vendor-advisory
- DSA-071 vendor-advisory
- fetchmail-signed-integer-index(6965) vdb-entry
- MDKSA-2001:072 vendor-advisory
- ESA-20010816-01 patch vendor-advisory
- SuSE-SA:2001:026 vendor-advisory
- RHSA-2001:103 patch vendor-advisory
- 3164 exploit patch vdb-entry vendor-advisory
- 3166 exploit patch vdb-entry vendor-advisory