CVE-2005-2335

NameCVE-2005-2335
DescriptionBuffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-774-1
NVD severitymedium (attack range: remote)
Debian Bugs212762, 320357
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
fetchmail (PTS)squeeze6.3.18-2fixed
wheezy6.3.21-4fixed
jessie, sid6.3.26-1fixed

The information above is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
fetchmailsource(unstable)6.2.5-16medium212762, 320357
fetchmailsourcesarge6.2.5-12sarge1mediumDSA-774-1
fetchmailsourcewoody(not affected)DSA-774-1

Notes

previous fix in -15 was broken

Search for package or bug name: Reporting problems