CVE-2010-0562

Name	CVE-2010-0562
Description	The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fetchmail (PTS)	buster	6.4.0~beta4-3+deb10u1	fixed
	bullseye	6.4.16-4+deb11u1	fixed
	bookworm, sid	6.4.37-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
fetchmail	source	etch	(not affected)
fetchmail	source	lenny	(not affected)
fetchmail	source	(unstable)	6.3.13-2	low

Notes

[lenny] - fetchmail <not-affected> (This issue was introduced in 6.3.11)
[etch] - fetchmail <not-affected> (This issue was introduced in 6.3.11)
the conditions so that this is exploitable are rather obscure