Read the docs
TI-2005-04091 Aliases CVE-2005-4348GHSA-5g7c-7whj-r862

fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows…

Priority MEDIUM 40CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.

Why it matters now

EPSS 0.03641 89th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fetchmail:fetchmail:*:*:*:*:*:*:*:*6.2.0 to before 6.2.5.5; 6.3.0 to before 6.3.1Vulnerablefetchmail
  • cpe:2.3:a:fetchmail:fetchmail:*:*:*:*:*:*:*:* Versions 6.2.0 to before 6.2.5.5; 6.3.0 to before 6.3.1 Vulnerable ·fetchmail

Remediation

Red Hat 1 advisory

  • RHSA-2007:0018 Released 2007-01-31 · Red Hat rating Moderate
    fetchmail security update
    • Red Hat Desktop version 3 fetchmail-6.2.0-3.el3.3, fetchmail-6.2.0-3.el3.3.i386
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1 fetchmail-5.9.0-21.7.3.el2.1.4, fetchmail-5.9.0-21.7.3.el2.1.4.i386, fetchmail-5.9.0-21.7.3.el2.1.4.ia64 +2
    • Red Hat Enterprise Linux AS version 3 fetchmail-6.2.0-3.el3.3, fetchmail-6.2.0-3.el3.3.i386, fetchmail-6.2.0-3.el3.3.ia64 +1
    • Red Hat Enterprise Linux AS version 4 fetchmail-6.2.5-6.el4.5, fetchmail-6.2.5-6.el4.5.i386, fetchmail-6.2.5-6.el4.5.ia64 +1
    • Red Hat Enterprise Linux Desktop version 4 fetchmail-6.2.5-6.el4.5, fetchmail-6.2.5-6.el4.5.i386
    • Red Hat Enterprise Linux ES version 2.1 fetchmail-5.9.0-21.7.3.el2.1.4, fetchmail-5.9.0-21.7.3.el2.1.4.i386, fetchmailconf-5.9.0-21.7.3.el2.1.4.i386
    • Red Hat Enterprise Linux ES version 3 fetchmail-6.2.0-3.el3.3, fetchmail-6.2.0-3.el3.3.i386, fetchmail-6.2.0-3.el3.3.ia64
    • Red Hat Enterprise Linux ES version 4 fetchmail-6.2.5-6.el4.5, fetchmail-6.2.5-6.el4.5.i386, fetchmail-6.2.5-6.el4.5.ia64
    • Red Hat Enterprise Linux WS version 2.1 fetchmail-5.9.0-21.7.3.el2.1.4, fetchmail-5.9.0-21.7.3.el2.1.4.i386, fetchmailconf-5.9.0-21.7.3.el2.1.4.i386
    • Red Hat Enterprise Linux WS version 3 fetchmail-6.2.0-3.el3.3, fetchmail-6.2.0-3.el3.3.i386, fetchmail-6.2.0-3.el3.3.ia64
    • Red Hat Enterprise Linux WS version 4 fetchmail-6.2.5-6.el4.5, fetchmail-6.2.5-6.el4.5.i386, fetchmail-6.2.5-6.el4.5.ia64
    • Red Hat Linux Advanced Workstation 2.1 fetchmail-5.9.0-21.7.3.el2.1.4, fetchmail-5.9.0-21.7.3.el2.1.4.ia64, fetchmailconf-5.9.0-21.7.3.el2.1.4.ia64

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2007:0018
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2007:0018
Red Hat Enterprise Linux AS version 3Fixed RHSA-2007:0018
Red Hat Enterprise Linux AS version 4Fixed RHSA-2007:0018
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2007:0018
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2007:0018
Red Hat Enterprise Linux ES version 3Fixed RHSA-2007:0018
Red Hat Enterprise Linux ES version 4Fixed RHSA-2007:0018
Red Hat Enterprise Linux WS version 2.1Fixed RHSA-2007:0018
Red Hat Enterprise Linux WS version 3Fixed RHSA-2007:0018
Red Hat Enterprise Linux WS version 4Fixed RHSA-2007:0018
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2007:0018

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-4348
  2. 2026-10-03 Alias added: GHSA-5g7c-7whj-r862

References

Advisory 11

Other 2

  • TI-2001-00964 Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or… CVSS 2.0HIGH 10.0
  • TI-2001-00101 Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command. CVSS 2.0HIGH 10.0
  • TI-2001-00782 A buffer overflow in Linux fetchmail before 5.8.6 allows remote attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2006-05756 fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda… CVSS 2.0HIGH 7.8
  • TI-2006-05650 fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext… CVSS 2.0HIGH 7.8
  • TI-2002-01289 Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@"… CVSS 2.0HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences