CVE-2005-4348
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote...
CVE-2005-4348 is a high vulnerability (CVSS 7.8) in Fetchmail, published December 21, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.64%, the 89th percentile. Fixed in fetchmail 6.3.1-1.
- Severity
- 7.8 HighCVSS 2.0, NVD
- Exploit chance
- 3.64%EPSS, 89th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.3.1-1fetchmail +27 more
Description
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fetchmailDebian:12 | before 6.3.1-1 | 6.3.1-1 |
fetchmailDebian:13 | before 6.3.1-1 | 6.3.1-1 |
fetchmailDebian:14 | before 6.3.1-1 | 6.3.1-1 |
fetchmailDebian:3.1 | before 6.2.5-12sarge4, plus listed versions 6.2.5-126.2.5-12sarge16.2.5-12sarge26.2.5-12sarge3 | 6.2.5-12sarge4 |
fetchmailRed Hat:enterprise_linux:2.1::as From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailconfRed Hat:enterprise_linux:2.1::as From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailRed Hat:enterprise_linux:2.1::aw From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailconfRed Hat:enterprise_linux:2.1::aw From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailRed Hat:enterprise_linux:2.1::es From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailconfRed Hat:enterprise_linux:2.1::es From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
fetchmailRed Hat:enterprise_linux:2.1::ws From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailconfRed Hat:enterprise_linux:2.1::ws From an advisory covering 2 CVEs | before 0:5.9.0-21.7.3.el2.1.4 | 0:5.9.0-21.7.3.el2.1.4 |
fetchmailRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmailRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmailRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmailRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmail-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs | before 0:6.2.0-3.el3.3 | 0:6.2.0-3.el3.3 |
fetchmailRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmailRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmailRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmailRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
fetchmail-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs | before 0:6.2.5-6.el4.5 | 0:6.2.5-6.el4.5 |
What each source reports
NVD Score used
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
- Record
CVE-2005-4348- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE ListNo score
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
- Record
CVE-2005-4348- Updated
- 2026-11-02
EUVDEUVD-2005-4343No score
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
- Record
EUVD-2005-4343- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5g7c-7whj-r862No score
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote...
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
- Record
GHSA-5g7c-7whj-r862- Updated
- 2026-11-02
OSVNo score
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
- Record
CVE-2005-4348- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-4348No score
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
- Record
DEBIAN-CVE-2005-4348- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/18266
vupen.com/english/advisories/2006/3101
securityfocus.com/archive/1/420098/100/0/threaded
Show 39 moreShow less
securitytracker.com/id?1015383
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.443499
trustix.org/errata/2006/0002
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9659
bugs.debian.org/cgi-bin/bugreport.cgi?bug=343836
exchange.xforce.ibmcloud.com/vulnerabilities/23713
novell.com/linux/security/advisories/2007_4_sr.html
usn.ubuntu.com/233-1
osvdb.org/21906
wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:236
redhat.com/support/errata/RHSA-2007-0018.html
debian.org/security/2005/dsa-939
fetchmail.berlios.de/fetchmail-SA-2005-03.txt
nvd.nist.gov/vuln/detail/CVE-2005-4348
github.com/advisories/GHSA-5g7c-7whj-r862
security-tracker.debian.org/tracker/CVE-2005-4348
access.redhat.com/errata/RHSA-2007:0018
bugzilla.redhat.com/show_bug.cgi?id=176266
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0018.json
cve.org/CVERecord?id=CVE-2005-4348