CVE-2002-1365 Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary...
HighCVSS 7.5
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fetchmail | <= 6.1.3 | No fix listed |
| fetchmail | = 4.5.1 | No fix listed |
| fetchmail | = 4.5.2 | No fix listed |
| fetchmail | = 4.5.3 | No fix listed |
| fetchmail | = 4.5.4 | No fix listed |
| fetchmail | = 4.5.5 | No fix listed |
| fetchmail | = 4.5.6 | No fix listed |
| fetchmail | = 4.5.7 | No fix listed |
| fetchmail | = 4.5.8 | No fix listed |
| fetchmail | = 4.6.0 | No fix listed |
| fetchmail | = 4.6.1 | No fix listed |
| fetchmail | = 4.6.2 | No fix listed |
| fetchmail | = 4.6.3 | No fix listed |
| fetchmail | = 4.6.4 | No fix listed |
| fetchmail | = 4.6.5 | No fix listed |
| fetchmail | = 4.6.6 | No fix listed |
| fetchmail | = 4.6.7 | No fix listed |
| fetchmail | = 4.6.8 | No fix listed |
| fetchmail | = 4.6.9 | No fix listed |
| fetchmail | = 4.7.0 | No fix listed |
| fetchmail | = 4.7.1 | No fix listed |
| fetchmail | = 4.7.2 | No fix listed |
| fetchmail | = 4.7.3 | No fix listed |
| fetchmail | = 4.7.4 | No fix listed |
| fetchmail | = 4.7.5 | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| fetchmail | = 4.7.6 | No fix listed |
| fetchmail | = 4.7.7 | No fix listed |
| fetchmail | = 5.0.0 | No fix listed |
| fetchmail | = 5.0.1 | No fix listed |
| fetchmail | = 5.0.2 | No fix listed |
| fetchmail | = 5.0.3 | No fix listed |
| fetchmail | = 5.0.4 | No fix listed |
| fetchmail | = 5.0.5 | No fix listed |
| fetchmail | = 5.0.6 | No fix listed |
| fetchmail | = 5.0.7 | No fix listed |
| fetchmail | = 5.0.8 | No fix listed |
| fetchmail | = 5.1.0 | No fix listed |
| fetchmail | = 5.1.4 | No fix listed |
| fetchmail | = 5.2.0 | No fix listed |
| fetchmail | = 5.2.1 | No fix listed |
| fetchmail | = 5.2.3 | No fix listed |
| fetchmail | = 5.2.4 | No fix listed |
| fetchmail | = 5.2.7 | No fix listed |
| fetchmail | = 5.2.8 | No fix listed |
| fetchmail | = 5.3.0 | No fix listed |
| fetchmail | = 5.3.1 | No fix listed |
| fetchmail | = 5.3.3 | No fix listed |
| fetchmail | = 5.3.8 | No fix listed |
| fetchmail | = 5.4.0 | No fix listed |
| fetchmail | = 5.4.3 | No fix listed |
| fetchmail | = 5.4.4 | No fix listed |
| fetchmail | = 5.4.5 | No fix listed |
| fetchmail | = 5.5.0 | No fix listed |
| fetchmail | = 5.5.2 | No fix listed |
| fetchmail | = 5.5.3 | No fix listed |
| fetchmail | = 5.5.5 | No fix listed |
| fetchmail | = 5.5.6 | No fix listed |
| fetchmail | = 5.6.0 | No fix listed |
| fetchmail | = 5.7.0 | No fix listed |
| fetchmail | = 5.7.2 | No fix listed |
| fetchmail | = 5.7.4 | No fix listed |
| fetchmail | = 5.8 | No fix listed |
| fetchmail | = 5.8.1 | No fix listed |
| fetchmail | = 5.8.2 | No fix listed |
| fetchmail | = 5.8.3 | No fix listed |
| fetchmail | = 5.8.4 | No fix listed |
| fetchmail | = 5.8.5 | No fix listed |
| fetchmail | = 5.8.6 | No fix listed |
| fetchmail | = 5.8.11 | No fix listed |
| fetchmail | = 5.8.13 | No fix listed |
| fetchmail | = 5.8.14 | No fix listed |
| fetchmail | = 5.8.17 | No fix listed |
| fetchmail | = 5.9.0 | No fix listed |
| fetchmail | = 5.9.4 | No fix listed |
| fetchmail | = 5.9.5 | No fix listed |
| fetchmail | = 5.9.8 | No fix listed |
| fetchmail | = 5.9.10 | No fix listed |
| fetchmail | = 5.9.11 | No fix listed |
| fetchmail | = 5.9.13 | No fix listed |
| fetchmail | = 6.0.0 | No fix listed |
| fetchmail | = 6.1.0 | No fix listed |
| debian/fetchmail(Debian:12) | < 6.2.0-1 | 6.2.0-1 |
| debian/fetchmail(Debian:13) | < 6.2.0-1 | 6.2.0-1 |
| debian/fetchmail(Debian:14) | < 6.2.0-1 | 6.2.0-1 |
References
- CLA-2002:554 vendor-advisory
- 20021213 Advisory 05/2002: Another Fetchmail Remote Vulnerability mailing-list
- 20021215 GLSA: fetchmail mailing-list
- security.e-matters.de
- DSA-216 vendor-advisory
- MDKSA-2003:011 vendor-advisory
- RHSA-2002:293 patch vendor-advisory
- RHSA-2002:294 vendor-advisory
- RHSA-2003:155 vendor-advisory
- 6390 vdb-entry
- fetchmail-address-header-bo(10839) vdb-entry
- Debian Security Tracker CVE-2002-1365 vendor-advisory