1 -----BEGIN PGP SIGNED MESSAGE-----
4 fetchmail-SA-2006-01: crash when bouncing messages.
6 Topics: #1 crash when bouncing a message
7 #2 fetchmail 6.2.5.X end of life
9 Author: Matthias Andree
12 Type: free() with bogus pointer
13 Impact: fetchmail crashes
15 Credits: Nathaniel W. Turner (bug report)
16 CVE Name: CVE-2006-0321
17 URL: http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt
18 http://bugs.debian.org/348747
19 Project URL: http://fetchmail.berlios.de/
21 Affects: fetchmail release >= 6.3.0
22 fetchmail release < 6.3.2
23 fetchmail release candidates 6.3.2-rc1, -rc2 and -rc3
25 Not affected: fetchmail release candidate 6.3.2-rc4
26 fetchmail release 6.3.2
27 other versions not mentioned here or in the previous
28 sections have not been checked
30 Corrected: 2006-01-19 fetchmail 6.3.2-rc4
31 2006-01-22 fetchmail 6.3.2
37 2006-01-19 internal review draft
39 2006-01-22 release 1.0
40 2006-01-25 release 1.1, add fetchmail 6.3.2 to "Not affected" above.
46 fetchmail is a software package to retrieve mail from remote POP2, POP3,
47 IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
48 message delivery agents.
50 fetchmail ships with a graphical, Python/Tkinter based configuration
51 utility named "fetchmailconf" to help the user create configuration (run
52 control) files for fetchmail.
55 2. Problem description and Impact
56 =================================
58 Fetchmail contains a bug that causes itself to crash when bouncing a
59 message to the originator or to the local postmaster. The crash happens
60 after the bounce message has been sent, when fetchmail tries to free the
61 dynamic array of failed addresses, and calls the free() function with an
62 invalid pointer. This bug was introduced short before fetchmail 6.3.0
63 and is not present in the now discontinued 6.2.X series (see below).
69 None known at this time.
75 Download and install fetchmail 6.3.2 or a newer stable release from
76 fetchmail's project site at
77 <http://developer.berlios.de/project/showfiles.php?group_id=1824>.
80 5. End of life announcement
81 ===========================
83 The aged fetchmail 6.2.5.X branch is discontinued effective immediately.
84 No further releases from the 6.2.5.X branch will be made.
86 The new 6.3.X stable branch has been available since 2005-11-30
87 and will not change except for bugfixes, documentation and message
91 A. Copyright, License and Warranty
92 ==================================
94 (C) Copyright 2006 by Matthias Andree, <matthias.andree@gmx.de>.
97 This work is licensed under the Creative Commons
98 Attribution-NonCommercial-NoDerivs German License. To view a copy of
99 this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
100 or send a letter to Creative Commons; 559 Nathan Abbott Way;
101 Stanford, California 94305; USA.
103 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
104 Use the information herein at your own risk.
106 END OF fetchmail-SA-2006-01.txt
107 -----BEGIN PGP SIGNATURE-----
108 Version: GnuPG v1.4.5 (GNU/Linux)
110 iD8DBQFIV7WXvmGDOQUufZURAtJBAKCjxJ3q11MxXxAWqqFYlB/z0uJMVwCeLc2O
111 SHK7Gu7QlDzSv3lahIbLUTU=
113 -----END PGP SIGNATURE-----