Matthias Andree

**Name of the Vulnerable Software and Affected Versions** fetchmail versions prior to 6.5.6 **Description** The SMTP client in fetchmail can experience a crash during authentication when it receives a 334 status code in a malformed context. **Recommendations** Update to fetchmail version 6.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Fetchmail versions 5.0.8 through 6.3.21 **Description** The issue allows remote NTLM servers to cause a denial of service, resulting in a crash and delayed delivery of inbound mail, via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder. Additionally, it enables remote NTLM servers to obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read. **Recommendations** For Fetchmail versions 5.0.8 through 6.3.21, consider disabling NTLM authentication in debug mode until a patch is available. Restrict access to the base64 decoder function to minimize the risk of exploitation. Avoid using the NTLM authentication protocol with debug mode enabled in the affected Fetchmail versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** fetchmail versions 6.3.11 through 6.3.13 **Description** The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set. This triggers a heap-based buffer overflow during escaping in the `sdump` function when running in verbose mode on platforms for which `char` is signed. **Recommendations** For fetchmail versions 6.3.11 through 6.3.13, consider disabling the verbose mode as a temporary workaround until a patch is available. Restrict access to SSL X.509 certificates to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** fetchmail versions prior to 6.3.11 **Description** The issue arises from improper handling of a '0' character in a domain name within the subject's Common Name (CN) field of an X.509 certificate in socket.c. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. **Recommendations** For versions prior to 6.3.11, update to version 6.3.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL connections to trusted servers until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.16 **Description** The issue allows remote attackers to cause a denial of service, resulting in a process crash and denying access to NFS exports. This is achieved through unspecified vectors that trigger a kernel oops (null dereference) and a deadlock. **Recommendations** For Linux kernel versions prior to 2.6.16, update to version 2.6.16 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CVSup version 16.1h **Description** The issue concerns certain third-party packages for CVSup that contain untrusted paths in the ELF RPATH fields of certain executables. This could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries created in world-writable directories. **Recommendations** For CVSup version 16.1h, consider restricting access to world-writable directories to minimize the risk of exploitation. As a temporary workaround, avoid using the vulnerable executables until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.