| Name | CVE-2010-0562 |
| Description | The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| fetchmail (PTS) | jessie | 6.3.26-1 | fixed |
| stretch | 6.3.26-3 | fixed | |
| buster | 6.4.0~beta4-3+deb10u1 | fixed | |
| bullseye | 6.4.16-4+deb11u1 | fixed | |
| bookworm | 6.4.37-1 | fixed | |
| sid, trixie | 6.4.39-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| fetchmail | source | etch | (not affected) | |||
| fetchmail | source | lenny | (not affected) | |||
| fetchmail | source | (unstable) | 6.3.13-2 | low |
[lenny] - fetchmail <not-affected> (This issue was introduced in 6.3.11)
[etch] - fetchmail <not-affected> (This issue was introduced in 6.3.11)
the conditions so that this is exploitable are rather obscure