Bug 307761 – <net-mail/fetchmail-6.3.14 X.509-related heap overflow in verbose mode (CVE-2010-0562)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Alex Legler (RETIRED) 2010-03-04 12:02:45 UTC]

CVE-2010-0562 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0562):
  The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and
  6.3.13, when running in verbose mode on platforms for which char is
  signed, allows remote attackers to cause a denial of service
  (application crash) or possibly execute arbitrary code via an SSL
  X.509 certificate containing non-printable characters with the high
  bit set, which triggers a heap-based buffer overflow during escaping.

[Comment 1 Alex Legler (RETIRED) 2010-03-04 12:20:21 UTC]

Can we go stable with 6.3.14?

[Comment 2 Torsten Veller (RETIRED) 2010-03-04 13:15:16 UTC]

(In reply to comment #1)
> Can we go stable with 6.3.14?

Yes. Please stabilize =net-mail/fetchmail-6.3.14

[Comment 3 Christian Faulhammer (RETIRED) 2010-03-04 13:43:50 UTC]

x86 stable

[Comment 4 Raúl Porcel (RETIRED) 2010-03-04 19:42:34 UTC]

alpha/arm/ia64/s390/sh/sparc stable

[Comment 5 Markus Meier 2010-03-07 15:37:23 UTC]

  05 Mar 2010; Torsten Veller <[e-mail]> fetchmail-6.3.14.ebuild:
  Stable on amd64 (#307761)

[Comment 6 Brent Baude (RETIRED) 2010-03-08 19:45:25 UTC]

ppc64 done

[Comment 7 Joe Jezak (RETIRED) 2010-03-09 22:13:13 UTC]

Marked ppc stable.

[Comment 8 Jeroen Roovers (RETIRED) 2010-03-10 11:08:35 UTC]

Stable for HPPA.

[Comment 9 Torsten Veller (RETIRED) 2010-03-29 15:35:13 UTC]

All arches done

[Comment 10 Stefan Behte (RETIRED) 2010-03-29 22:13:25 UTC]

Thanks everyone, GLSA request filed.

[Comment 11 Alex Legler (RETIRED) 2010-06-02 21:23:22 UTC]

GLSA 201006-12