Every CVE Search/ Get API key

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in...

6.4 MediumFix available

CVE-2009-2666 is a medium vulnerability (CVSS 6.4) in Fetchmail, published August 7, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in fetchmail 6.3.9~rc2-6.

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

1.50%Down 1.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.4

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-2666
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-2666
Updated
2026-11-02
EUVDEUVD-2009-2659 No score

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
EUVD-2009-2659
Updated
2026-11-03
GitHub AdvisoriesGHSA-f5g6-55mc-jx72 No score

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in...

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
GHSA-f5g6-55mc-jx72
Updated
2026-11-02
OSV No score

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-2666
Updated
2026-11-02
OSVDEBIAN-CVE-2009-2666 No score

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
DEBIAN-CVE-2009-2666
Updated
2026-11-02
OSVopenSUSE-SU-2024:10194-1 No score

fetchmail-6.3.26-13.4 on GA media

These are all security issues fixed in the fetchmail-6.3.26-13.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10194-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fetchmail
Debian:12
 before 6.3.9~rc2-6
6.3.9~rc2-6
fetchmail
Debian:13
 before 6.3.9~rc2-6
6.3.9~rc2-6
fetchmail
Debian:14
 before 6.3.9~rc2-6
6.3.9~rc2-6
fetchmail
Debian:4.0
 before 6.3.6-1etch2, plus listed versions
6.3.6-16.3.6-1etch1
6.3.6-1etch2
fetchmail
Debian:5.0
 before 6.3.9~rc2-4+lenny1, plus listed versions
6.3.9~rc2-4
6.3.9~rc2-4+lenny1
fetchmail
Red Hat:enterprise_linux:3::as
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail
Red Hat:enterprise_linux:3::desktop
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail
Red Hat:enterprise_linux:3::es
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
Show 16 moreShow less
Affected packages
PackageAffectedFixed
fetchmail-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail
Red Hat:enterprise_linux:3::ws
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:6.2.0-3.el3.5
0:6.2.0-3.el3.5
fetchmail
Red Hat:enterprise_linux:4::as
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail
Red Hat:enterprise_linux:4::desktop
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail
Red Hat:enterprise_linux:4::es
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail
Red Hat:enterprise_linux:4::ws
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:6.2.5-6.0.1.el4_8.1
0:6.2.5-6.0.1.el4_8.1
fetchmail
Red Hat:enterprise_linux:5::client_workstation
 before 0:6.3.6-1.1.el5_3.1
0:6.3.6-1.1.el5_3.1
fetchmail-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:6.3.6-1.1.el5_3.1
0:6.3.6-1.1.el5_3.1
fetchmail
Red Hat:enterprise_linux:5::server
 before 0:6.3.6-1.1.el5_3.1
0:6.3.6-1.1.el5_3.1
fetchmail-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:6.3.6-1.1.el5_3.1
0:6.3.6-1.1.el5_3.1
fetchmail
openSUSE:Tumbleweed
 before 6.3.26-13.4
6.3.26-13.4

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open