CVE-2001-1009 describes a critical vulnerability in Fetchmail (specifically versions before 5.8.17), where a malicious IMAP or POP/POP3 server can exploit a negative index number in a LIST response to overwrite arbitrary memory. This flaw carries a CVSS score of 10.0, indicating maximum severity with network-based exploitation, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed on the CISA KEV catalog, public exploit code exists on ExploitDB, demonstrating its feasibility. Despite its age and high severity, there is no recorded community discussion or media coverage for this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.8.14CPE matchmatch criteria | cpe:2.3:a:fetchmail:fetchmail:*:*:*:*:*:*:*:* | ||
4.5.1CPE matchmatch criteria | cpe:2.3:a:fetchmail:fetchmail:4.5.1:*:*:*:*:*:*:* | ||
4.5.2CPE matchmatch criteria | cpe:2.3:a:fetchmail:fetchmail:4.5.2:*:*:*:*:*:*:* | ||
4.5.3CPE matchmatch criteria | cpe:2.3:a:fetchmail:fetchmail:4.5.3:*:*:*:*:*:*:* | ||
4.5.4CPE matchmatch criteria | cpe:2.3:a:fetchmail:fetchmail:4.5.4:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.