diff options
| author | simon <simon@FreeBSD.org> | 2005-07-21 03:43:05 +0800 |
|---|---|---|
| committer | simon <simon@FreeBSD.org> | 2005-07-21 03:43:05 +0800 |
| commit | b96c6438ac4192955869af3975a62fc42d0d4c82 (patch) | |
| tree | 2075365462a88c51501eccd77556e1ee5db8a6b2 /security/vuxml | |
| parent | 5d42fe3d0497e9a5b35c9aede30b89287cb0fd6a (diff) | |
| download | freebsd-ports-gnome-b96c6438ac4192955869af3975a62fc42d0d4c82.tar.gz freebsd-ports-gnome-b96c6438ac4192955869af3975a62fc42d0d4c82.tar.zst freebsd-ports-gnome-b96c6438ac4192955869af3975a62fc42d0d4c82.zip | |
Document fetchmail -- remote root/code injection from malicious POP3
server.
Submitted by: Matthias Andree <matthias.andree@gmx.de>
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 2b750ec549ba..d76724f02bc1 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,34 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="3497d7be-2fef-45f4-8162-9063751b573a"> + <topic>fetchmail -- remote root/code injection from malicious POP3 server</topic> + <affects> + <package> + <name>fetchmail</name> + <range><lt>6.2.5.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>fetchmail's POP3/UIDL code does not truncate received UIDs properly. + A malicious or compromised POP3 server can thus corrupt fetchmail's + stack and inject code when fetchmail is using UIDL, either through + configuration, or as a result of certain server capabilities. Note + that fetchmail is run as root on some sites, so an attack might + compromise the root account and thus the whole machine.</p> + </body> + </description> + <references> + <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762</url> + <freebsdpr>ports/83805</freebsdpr> + </references> + <dates> + <discovery>2005-07-20</discovery> + <entry>2005-07-20</entry> + </dates> + </vuln> + <vuln vid="2e116ba5-f7c3-11d9-928e-000b5d7e6dd5"> <topic>kdebase -- Kate backup file permission leak</topic> <affects> |