CVE-2008-2711
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to...
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
Exploit likelihood
What each source reports
NVD Score used
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
- Record
CVE-2008-2711- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
- Record
CVE-2008-2711- Updated
- 2026-11-02
EUVDEUVD-2008-2705 No score
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
- Record
EUVD-2008-2705- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mgrc-7p8m-89r3 No score
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to...
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
- Record
GHSA-mgrc-7p8m-89r3- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
- Record
CVE-2008-2711- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2711 No score
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
- Record
DEBIAN-CVE-2008-2711- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fetchmailDebian:12 |
before 6.3.9~rc2-1 | 6.3.9~rc2-1 |
fetchmailDebian:13 |
before 6.3.9~rc2-1 | 6.3.9~rc2-1 |
fetchmailDebian:14 |
before 6.3.9~rc2-1 | 6.3.9~rc2-1 |
fetchmailRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmailRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmailRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmailRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
fetchmail-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs |
before 0:6.2.0-3.el3.5 | 0:6.2.0-3.el3.5 |
fetchmailRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmailRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmailRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmailRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:6.2.5-6.0.1.el4_8.1 | 0:6.2.5-6.0.1.el4_8.1 |
fetchmailRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:6.3.6-1.1.el5_3.1 | 0:6.3.6-1.1.el5_3.1 |
fetchmail-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:6.3.6-1.1.el5_3.1 | 0:6.3.6-1.1.el5_3.1 |
fetchmailRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:6.3.6-1.1.el5_3.1 | 0:6.3.6-1.1.el5_3.1 |
fetchmail-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:6.3.6-1.1.el5_3.1 | 0:6.3.6-1.1.el5_3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2711 is a medium vulnerability (CVSS 4.3) in Fetchmail, published June 16, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in fetchmail 6.3.9~rc2-1.
References
vupen.com/english/advisories/2008/1860/references
secunia.com/advisories/31287
securityfocus.com/archive/1/494865/100/0/threaded
securitytracker.com/id?1020298
Show 36 moreShow less
wiki.rpath.com/wiki/Advisories:rPSA-2008-0235
support.apple.com/kb/HT3438
lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
redhat.com/archives/fedora-package-announce/2008-June/msg01095.html
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740
fetchmail.info/fetchmail-SA-2008-01.txt
issues.rpath.com/browse/RPL-2623
bugzilla.novell.com/show_bug.cgi?id=354291
mandriva.com/security/advisories?name=MDVSA-2008:117
exchange.xforce.ibmcloud.com/vulnerabilities/43121
openwall.com/lists/oss-security/2008/06/13/1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10950
nvd.nist.gov/vuln/detail/CVE-2008-2711
github.com/advisories/GHSA-mgrc-7p8m-89r3
security-tracker.debian.org/tracker/CVE-2008-2711
access.redhat.com/errata/RHSA-2009:1427
bugzilla.redhat.com/show_bug.cgi?id=260601
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1427.json
cve.org/CVERecord?id=CVE-2007-4565