Red Hat Security AdvisoryRHSA-2009:1427
fetchmail security update
Released 2009-09-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 fetchmail-6.2.0-3.el3.5, fetchmail-6.2.0-3.el3.5.i386
- Red Hat Enterprise Linux (v. 5 server) fetchmail-6.3.6-1.1.el5_3.1, fetchmail-6.3.6-1.1.el5_3.1.i386, fetchmail-6.3.6-1.1.el5_3.1.ia64 +1
- Red Hat Enterprise Linux AS version 3 fetchmail-6.2.0-3.el3.5, fetchmail-6.2.0-3.el3.5.i386, fetchmail-6.2.0-3.el3.5.ia64 +1
- Red Hat Enterprise Linux AS version 4 fetchmail-6.2.5-6.0.1.el4_8.1, fetchmail-6.2.5-6.0.1.el4_8.1.i386, fetchmail-6.2.5-6.0.1.el4_8.1.ia64 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) fetchmail-6.3.6-1.1.el5_3.1, fetchmail-6.3.6-1.1.el5_3.1.i386
- Red Hat Enterprise Linux Desktop version 4 fetchmail-6.2.5-6.0.1.el4_8.1, fetchmail-6.2.5-6.0.1.el4_8.1.i386
- Red Hat Enterprise Linux ES version 3 fetchmail-6.2.0-3.el3.5, fetchmail-6.2.0-3.el3.5.i386, fetchmail-6.2.0-3.el3.5.ia64
- Red Hat Enterprise Linux ES version 4 fetchmail-6.2.5-6.0.1.el4_8.1, fetchmail-6.2.5-6.0.1.el4_8.1.i386, fetchmail-6.2.5-6.0.1.el4_8.1.ia64
- Red Hat Enterprise Linux WS version 3 fetchmail-6.2.0-3.el3.5, fetchmail-6.2.0-3.el3.5.i386, fetchmail-6.2.0-3.el3.5.ia64
- Red Hat Enterprise Linux WS version 4 fetchmail-6.2.5-6.0.1.el4_8.1, fetchmail-6.2.5-6.0.1.el4_8.1.i386, fetchmail-6.2.5-6.0.1.el4_8.1.ia64
Fixes 3 records
Priority LOW 31
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary…
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.01503 · Published 2009-08-07 · Fixed CWE-310
Priority LOW 27
sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01971 · Published 2007-08-28 · Fixed
Priority LOW 26
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which trigge…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.03003 · Published 2008-06-16 · Fixed CWE-20
THREATIST.IORead the docs