CVE-2001-1009

Fetchmail < 5.8.14 - Access Control

Title source: rule
STIX 2.1

Description

Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Salvatore Sanfilippo -antirez- · cremoteunix
https://www.exploit-db.com/exploits/21064
exploitdb WORKING POC VERIFIED
by Sanfillipo antirez · cremoteunix
https://www.exploit-db.com/exploits/21066

Scores

EPSS 0.3326
EPSS Percentile 96.9%

Details

CWE
CWE-264
Status published
Products (50)
fetchmail/fetchmail 4.5.1
fetchmail/fetchmail 4.5.2
fetchmail/fetchmail 4.5.3
fetchmail/fetchmail 4.5.4
fetchmail/fetchmail 4.5.5
fetchmail/fetchmail 4.5.6
fetchmail/fetchmail 4.5.7
fetchmail/fetchmail 4.5.8
fetchmail/fetchmail 4.6.0
fetchmail/fetchmail 4.6.1
... and 40 more
Published Aug 31, 2001
Tracked Since Feb 18, 2026