CVE-2005-2335Improper Restriction of Operations within the Bounds of a Memory Buffer in Fetchmail

Severity
5.0MEDIUMNVD
EPSS
6.4%
top 8.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 27
Latest updateMay 1

Description

Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

debiandebian/fetchmail< fetchmail 6.2.5-16 (bookworm)
Debianfetchmail/fetchmail< 6.2.5-16+2
NVDfetchmail/fetchmail6.2.5.1+88

Patches

🔴Vulnerability Details

2
GHSA
GHSA-64xp-j337-hw4c: Buffer overflow in the POP3 client in Fetchmail before 62022-05-01
OSV
CVE-2005-2335: Buffer overflow in the POP3 client in Fetchmail before 62005-07-27

📋Vendor Advisories

3
Ubuntu
fetchmail vulnerability2005-07-26
Red Hat
security flaw2005-07-21
Debian
CVE-2005-2335: fetchmail - Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP...2005

💬Community

2
Bugzilla
CVE-2005-2335 security flaw2018-08-16
Bugzilla
Security-update for buffer-overflow-vuln needed2005-08-12
CVE-2005-2335 — Debian Fetchmail vulnerability | cvebase