Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Fetchmail can be tricked into running malicious code

CVE-2001-1009 · published 25 years ago
Summary

Older versions of Fetchmail may accept specially crafted replies from a fake IMAP or POP server, causing the program to overwrite its own memory. This can let an attacker take control of the system or gain higher privileges. Upgrade to the latest Fetchmail release or stop using outdated versions to stay safe.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fetchmail fetchmail <= 5.8.14
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
59 more version ranges
cpe:2.3:a:fetchmail:fetchmail:*:*:*:*:*:*:*:*
Original advisory text
Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number a...
Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published31 Aug 2001
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2001-1009 · NVD
Track software like this
Free during beta