CVE-2021-36386

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

References

http://www.openwall.com/lists/oss-security/2021/07/28/5

https://www.fetchmail.info/fetchmail-SA-2021-01.txt

https://www.fetchmail.info/security.html

http://www.openwall.com/lists/oss-security/2021/08/09/1

https://lists.fedoraproject.org/archives/list/[email protected]/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/

https://lists.fedoraproject.org/archives/list/[email protected]/message/OIXKO6QW3AUHGJVWKJXBCOVBYJUJRBFC/

Details

Source: MITRE

Published: 2021-07-30

Updated: 2021-09-20

Type: CWE-400

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Tenable Plugins

View all (5 total)

IDNameProductFamilySeverity
152758openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:1183-1)NessusSuSE Local Security Checks
high
152721openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:2791-1)NessusSuSE Local Security Checks
high
152715SUSE SLED15 / SLES15 Security Update : fetchmail (SUSE-SU-2021:2791-1)NessusSuSE Local Security Checks
high
152677SUSE SLES12 Security Update : fetchmail (SUSE-SU-2021:2771-1)NessusSuSE Local Security Checks
high
152150FreeBSD : fetchmail -- 6.4.19 and older denial of service or information disclosure (cbfd1874-efea-11eb-8fe9-036bd763ff35)NessusFreeBSD Local Security Checks
high