22 results · Feed
-
Medium 5.3
Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while b…
-
Medium 5.9
In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malforme…
-
Unscored —
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation…
-
Unscored —
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, …
-
Unscored —
Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a…
-
Unscored —
fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) STLS request, …
-
Unscored —
fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-char…
-
Unscored —
The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for wh…
-
Unscored —
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common …
-
Unscored —
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of ser…
-
Unscored —
sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and …
-
Unscored —
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) at…
-
Unscored —
fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attacke…
-
Unscored —
fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if c…
-
Unscored —
fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafte…
-
Unscored —
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denia…
-
Unscored —
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readabl…
-
Unscored —
Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service …
-
Unscored —
Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffe…
-
Unscored —
Fetchmail 6.2.4 and earlier does not properly allocate memory for long lines, which allows remote attackers to cause a …
-
Unscored —
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute …
-
Unscored —
The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed …