Read the docs
TI-2010-00534 Aliases CVE-2010-0562GHSA-7xwr-ggr5-9p9v

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in…

Priority LOW 35CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping.

Why it matters now

EPSS 0.02487 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:fetchmail:fetchmail:6.3.11:*:*:*:*:*:*:*6.3.11Vulnerablefetchmail
cpe:2.3:a:fetchmail:fetchmail:6.3.12:*:*:*:*:*:*:*6.3.12Vulnerablefetchmail
cpe:2.3:a:fetchmail:fetchmail:6.3.13:*:*:*:*:*:*:*6.3.13Vulnerablefetchmail
  • cpe:2.3:a:fetchmail:fetchmail:6.3.11:*:*:*:*:*:*:* Versions 6.3.11 Vulnerable ·fetchmail
  • cpe:2.3:a:fetchmail:fetchmail:6.3.12:*:*:*:*:*:*:* Versions 6.3.12 Vulnerable ·fetchmail
  • cpe:2.3:a:fetchmail:fetchmail:6.3.13:*:*:*:*:*:*:* Versions 6.3.13 Vulnerable ·fetchmail

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-0562
  2. 2026-10-03 Alias added: GHSA-7xwr-ggr5-9p9v

References

Advisory 3

Other 2

  • TI-2001-00964 Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or… CVSS 2.0HIGH 10.0
  • TI-2001-00101 Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command. CVSS 2.0HIGH 10.0
  • TI-2001-00782 A buffer overflow in Linux fetchmail before 5.8.6 allows remote attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2006-05756 fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda… CVSS 2.0HIGH 7.8
  • TI-2006-05650 fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext… CVSS 2.0HIGH 7.8
  • TI-2002-01289 Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@"… CVSS 2.0HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences