Unrated
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers...
CVE-2021-36386
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-36386 fetchmail Fixed in: 6.4.16-4
Original description The description as published by the source.
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
References
- advisory security.gentoo.org
- advisory fetchmail.info
- advisory fetchmail.info
- patch openwall.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web openwall.com