CVE-2002-1174Improper Restriction of Operations within the Bounds of a Memory Buffer in Fetchmail

Severity
7.5HIGHNVD
EPSS
4.3%
top 11.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 11
Latest updateApr 30

Description

Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

debiandebian/fetchmail< fetchmail 6.1.0-1 (bookworm)
Debianfetchmail/fetchmail< 6.1.0-1+2
NVDfetchmail/fetchmail6.0.0+78

Patches

🔴Vulnerability Details

2
GHSA
GHSA-vqhj-2h3q-6ghm: Buffer overflows in Fetchmail 62022-04-30
OSV
CVE-2002-1174: Buffer overflows in Fetchmail 62002-10-11

📋Vendor Advisories

2
Red Hat
security flaw2002-09-29
Debian
CVE-2002-1174: fetchmail - Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause ...2002

💬Community

1
Bugzilla
CVE-2002-1174 security flaw2018-08-16
CVE-2002-1174 — Debian Fetchmail vulnerability | cvebase