DescriptionBuffer overflow in the POP3 client in Fetchmail before allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs212762, 320357

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
fetchmail (PTS)wheezy6.3.21-4fixed
stretch, sid6.3.26-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
fetchmailsource(unstable)6.2.5-16medium212762, 320357
fetchmailsourcewoody(not affected)DSA-774-1


previous fix in -15 was broken

Search for package or bug name: Reporting problems