CVE-2006-5974

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-31 · updated 2026-06-16
Weakness: CWE-20

Description

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.

Affected products

fetchmail: 6.3.5, 6.3.6-rc1, 6.3.6-rc2, 6.3.6-rc3

References

http://fedoranews.org/cms/node/2429
http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt
http://osvdb.org/31836
http://secunia.com/advisories/23631
http://secunia.com/advisories/23804
http://secunia.com/advisories/23838
http://secunia.com/advisories/23923
http://secunia.com/advisories/24151
http://security.gentoo.org/glsa/glsa-200701-13.xml
http://securitytracker.com/id?1017479
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.517995
http://www.novell.com/linux/security/advisories/2007_4_sr.html

Get alerted when CVE-2006-5974 or the next vulnerability affects your stack