FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-1167

This CVE name corresponds to:

Entered	Topic
2010-04-20	fetchmail -- denial of service vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-1167 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-1167
Phase	Assigned(20100329)

Description

fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3 UIDL list.

References

Source	Reference
BUGTRAQ	20100506 fetchmail security announcement fetchmail-SA-2010-02 (CVE-2010-1167)
CONFIRM	http://developer.berlios.de/project/shownotes.php?group_id=1824&release_id=17512
CONFIRM	http://www.fetchmail.info/fetchmail-SA-2010-02.txt
MANDRIVA	MDVSA-2011:107
BID	39556