CVE-2008-2711 [中] | Input Validation Bypass（Fetchmail）

fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.

#	日付	旧 EPSS スコア	新 EPSS スコア	Δ（新 − 旧）
1	2026-06-15	3.32%	3.00%	-0.31%
2	2025-03-30	6.44%	3.32%	-3.12%
3	2025-03-29	—	6.44%	—

日付

旧 EPSS スコア

新 EPSS スコア

Δ（新 − 旧）

2026-06-15

3.32%

3.00%

-0.31%

2025-03-30

6.44%

3.32%

-3.12%

2025-03-29

—

6.44%

—

ベーススコア	バージョン	深刻度	ベクトル	悪用しやすさ	影響	スコアの出典
4.3	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:N/I:N/A:P` クリックして展開アクセス経路 (AV:N) ルーティング可能なネットワーク越しに、遠隔から到達・悪用しうる。アクセスの複雑さ (AC:M) 多少の有利条件は要るが、極端なレアケースではない。認証 (AU:N) 認証を経ずに攻撃を完結できる。機密性への影響 (C:N) 機密性は損なわれない。完全性への影響 (I:N) 完全性は損なわれない。可用性への影響 (A:P) 可用性は部分的に損なわれる。	8.6	2.9	[email protected]

ベーススコア

バージョン

深刻度

ベクトル

悪用しやすさ

影響

スコアの出典

4.3

2.0

MEDIUM

AV:N/AC:M/Au:N/C:N/I:N/A:P クリックして展開

アクセス経路 (AV:N): ルーティング可能なネットワーク越しに、遠隔から到達・悪用しうる。
アクセスの複雑さ (AC:M): 多少の有利条件は要るが、極端なレアケースではない。
認証 (AU:N): 認証を経ずに攻撃を完結できる。
機密性への影響 (C:N): 機密性は損なわれない。
完全性への影響 (I:N): 完全性は損なわれない。
可用性への影響 (A:P): 可用性は部分的に損なわれる。

8.6

2.9

[email protected]

CVE-2008-2711 の OS トラッカー

vendor	priority	summary	link
`debian`	unimportant	CVE-2008-2711 unimportant priority: Debian including 1 source packages (fetchmail), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2008-2711
`redhat`	low	—	https://access.redhat.com/security/cve/CVE-2008-2711
`ubuntu`	negligible	CVE-2008-2711 negligible priority: Ubuntu including 1 source packages (fetchmail), 15 status rows across 15 suites (dapper, feisty, gutsy, hardy, intrepid, jaunty, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, upstream): not-affected 10, ignored 4, needs-triage 1.	https://ubuntu.com/security/CVE-2008-2711

CVE-2008-2711 のベンダーコメント（NVD）

Red Hat (2009-09-09T00:00:00)

This issue was addressed in fetchmail packages as shipped in Red Hat Enterprise Linux 3, 4, and 5 via: https://rhn.redhat.com/errata/RHSA-2009-1427.html

CVE-2008-2711 の影響を受けるソフトウェア／構成

ベンダー	製品	バージョン	生の CPE
fetchmail	fetchmail	<= 6.3.8	cpe:2.3:a:fetchmail:fetchmail::::::::
fetchmail	fetchmail	4.5.1	cpe:2.3:a:fetchmail:fetchmail:4.5.1:::::::*
fetchmail	fetchmail	4.5.2	cpe:2.3:a:fetchmail:fetchmail:4.5.2:::::::*
fetchmail	fetchmail	4.5.3	cpe:2.3:a:fetchmail:fetchmail:4.5.3:::::::*
fetchmail	fetchmail	4.5.4	cpe:2.3:a:fetchmail:fetchmail:4.5.4:::::::*
fetchmail	fetchmail	4.5.5	cpe:2.3:a:fetchmail:fetchmail:4.5.5:::::::*
fetchmail	fetchmail	4.5.6	cpe:2.3:a:fetchmail:fetchmail:4.5.6:::::::*
fetchmail	fetchmail	4.5.7	cpe:2.3:a:fetchmail:fetchmail:4.5.7:::::::*
fetchmail	fetchmail	4.5.8	cpe:2.3:a:fetchmail:fetchmail:4.5.8:::::::*
fetchmail	fetchmail	4.6.0	cpe:2.3:a:fetchmail:fetchmail:4.6.0:::::::*
fetchmail	fetchmail	4.6.1	cpe:2.3:a:fetchmail:fetchmail:4.6.1:::::::*
fetchmail	fetchmail	4.6.2	cpe:2.3:a:fetchmail:fetchmail:4.6.2:::::::*
fetchmail	fetchmail	4.6.3	cpe:2.3:a:fetchmail:fetchmail:4.6.3:::::::*
fetchmail	fetchmail	4.6.4	cpe:2.3:a:fetchmail:fetchmail:4.6.4:::::::*
fetchmail	fetchmail	4.6.5	cpe:2.3:a:fetchmail:fetchmail:4.6.5:::::::*
fetchmail	fetchmail	4.6.6	cpe:2.3:a:fetchmail:fetchmail:4.6.6:::::::*
fetchmail	fetchmail	4.6.7	cpe:2.3:a:fetchmail:fetchmail:4.6.7:::::::*
fetchmail	fetchmail	4.6.8	cpe:2.3:a:fetchmail:fetchmail:4.6.8:::::::*
fetchmail	fetchmail	4.6.9	cpe:2.3:a:fetchmail:fetchmail:4.6.9:::::::*
fetchmail	fetchmail	4.7.0	cpe:2.3:a:fetchmail:fetchmail:4.7.0:::::::*
fetchmail	fetchmail	4.7.1	cpe:2.3:a:fetchmail:fetchmail:4.7.1:::::::*
fetchmail	fetchmail	4.7.2	cpe:2.3:a:fetchmail:fetchmail:4.7.2:::::::*
fetchmail	fetchmail	4.7.3	cpe:2.3:a:fetchmail:fetchmail:4.7.3:::::::*
fetchmail	fetchmail	4.7.4	cpe:2.3:a:fetchmail:fetchmail:4.7.4:::::::*
fetchmail	fetchmail	4.7.5	cpe:2.3:a:fetchmail:fetchmail:4.7.5:::::::*
fetchmail	fetchmail	4.7.6	cpe:2.3:a:fetchmail:fetchmail:4.7.6:::::::*
fetchmail	fetchmail	4.7.7	cpe:2.3:a:fetchmail:fetchmail:4.7.7:::::::*
fetchmail	fetchmail	5.0.0	cpe:2.3:a:fetchmail:fetchmail:5.0.0:::::::*
fetchmail	fetchmail	5.0.1	cpe:2.3:a:fetchmail:fetchmail:5.0.1:::::::*
fetchmail	fetchmail	5.0.2	cpe:2.3:a:fetchmail:fetchmail:5.0.2:::::::*
fetchmail	fetchmail	5.0.3	cpe:2.3:a:fetchmail:fetchmail:5.0.3:::::::*
fetchmail	fetchmail	5.0.4	cpe:2.3:a:fetchmail:fetchmail:5.0.4:::::::*
fetchmail	fetchmail	5.0.5	cpe:2.3:a:fetchmail:fetchmail:5.0.5:::::::*
fetchmail	fetchmail	5.0.6	cpe:2.3:a:fetchmail:fetchmail:5.0.6:::::::*
fetchmail	fetchmail	5.0.7	cpe:2.3:a:fetchmail:fetchmail:5.0.7:::::::*
fetchmail	fetchmail	5.0.8	cpe:2.3:a:fetchmail:fetchmail:5.0.8:::::::*
fetchmail	fetchmail	5.1.0	cpe:2.3:a:fetchmail:fetchmail:5.1.0:::::::*
fetchmail	fetchmail	5.1.4	cpe:2.3:a:fetchmail:fetchmail:5.1.4:::::::*
fetchmail	fetchmail	5.2.0	cpe:2.3:a:fetchmail:fetchmail:5.2.0:::::::*
fetchmail	fetchmail	5.2.1	cpe:2.3:a:fetchmail:fetchmail:5.2.1:::::::*
fetchmail	fetchmail	5.2.3	cpe:2.3:a:fetchmail:fetchmail:5.2.3:::::::*
fetchmail	fetchmail	5.2.4	cpe:2.3:a:fetchmail:fetchmail:5.2.4:::::::*
fetchmail	fetchmail	5.2.7	cpe:2.3:a:fetchmail:fetchmail:5.2.7:::::::*
fetchmail	fetchmail	5.2.8	cpe:2.3:a:fetchmail:fetchmail:5.2.8:::::::*
fetchmail	fetchmail	5.3.0	cpe:2.3:a:fetchmail:fetchmail:5.3.0:::::::*
fetchmail	fetchmail	5.3.1	cpe:2.3:a:fetchmail:fetchmail:5.3.1:::::::*
fetchmail	fetchmail	5.3.3	cpe:2.3:a:fetchmail:fetchmail:5.3.3:::::::*
fetchmail	fetchmail	5.3.8	cpe:2.3:a:fetchmail:fetchmail:5.3.8:::::::*
fetchmail	fetchmail	5.4.0	cpe:2.3:a:fetchmail:fetchmail:5.4.0:::::::*
fetchmail	fetchmail	5.4.3	cpe:2.3:a:fetchmail:fetchmail:5.4.3:::::::*
fetchmail	fetchmail	5.4.4	cpe:2.3:a:fetchmail:fetchmail:5.4.4:::::::*
fetchmail	fetchmail	5.4.5	cpe:2.3:a:fetchmail:fetchmail:5.4.5:::::::*
fetchmail	fetchmail	5.5.0	cpe:2.3:a:fetchmail:fetchmail:5.5.0:::::::*
fetchmail	fetchmail	5.5.2	cpe:2.3:a:fetchmail:fetchmail:5.5.2:::::::*
fetchmail	fetchmail	5.5.3	cpe:2.3:a:fetchmail:fetchmail:5.5.3:::::::*
fetchmail	fetchmail	5.5.5	cpe:2.3:a:fetchmail:fetchmail:5.5.5:::::::*
fetchmail	fetchmail	5.5.6	cpe:2.3:a:fetchmail:fetchmail:5.5.6:::::::*
fetchmail	fetchmail	5.6.0	cpe:2.3:a:fetchmail:fetchmail:5.6.0:::::::*
fetchmail	fetchmail	5.7.0	cpe:2.3:a:fetchmail:fetchmail:5.7.0:::::::*
fetchmail	fetchmail	5.7.2	cpe:2.3:a:fetchmail:fetchmail:5.7.2:::::::*
fetchmail	fetchmail	5.7.4	cpe:2.3:a:fetchmail:fetchmail:5.7.4:::::::*
fetchmail	fetchmail	5.8	cpe:2.3:a:fetchmail:fetchmail:5.8:::::::*
fetchmail	fetchmail	5.8.1	cpe:2.3:a:fetchmail:fetchmail:5.8.1:::::::*
fetchmail	fetchmail	5.8.2	cpe:2.3:a:fetchmail:fetchmail:5.8.2:::::::*
fetchmail	fetchmail	5.8.3	cpe:2.3:a:fetchmail:fetchmail:5.8.3:::::::*
fetchmail	fetchmail	5.8.4	cpe:2.3:a:fetchmail:fetchmail:5.8.4:::::::*
fetchmail	fetchmail	5.8.5	cpe:2.3:a:fetchmail:fetchmail:5.8.5:::::::*
fetchmail	fetchmail	5.8.6	cpe:2.3:a:fetchmail:fetchmail:5.8.6:::::::*
fetchmail	fetchmail	5.8.11	cpe:2.3:a:fetchmail:fetchmail:5.8.11:::::::*
fetchmail	fetchmail	5.8.13	cpe:2.3:a:fetchmail:fetchmail:5.8.13:::::::*
fetchmail	fetchmail	5.8.14	cpe:2.3:a:fetchmail:fetchmail:5.8.14:::::::*
fetchmail	fetchmail	5.8.17	cpe:2.3:a:fetchmail:fetchmail:5.8.17:::::::*
fetchmail	fetchmail	5.9.0	cpe:2.3:a:fetchmail:fetchmail:5.9.0:::::::*
fetchmail	fetchmail	5.9.4	cpe:2.3:a:fetchmail:fetchmail:5.9.4:::::::*
fetchmail	fetchmail	5.9.5	cpe:2.3:a:fetchmail:fetchmail:5.9.5:::::::*
fetchmail	fetchmail	5.9.8	cpe:2.3:a:fetchmail:fetchmail:5.9.8:::::::*
fetchmail	fetchmail	5.9.10	cpe:2.3:a:fetchmail:fetchmail:5.9.10:::::::*
fetchmail	fetchmail	5.9.11	cpe:2.3:a:fetchmail:fetchmail:5.9.11:::::::*
fetchmail	fetchmail	5.9.13	cpe:2.3:a:fetchmail:fetchmail:5.9.13:::::::*
fetchmail	fetchmail	6.0.0	cpe:2.3:a:fetchmail:fetchmail:6.0.0:::::::*

CVE-2008-2711 の参考情報

URL	タグ
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://secunia.com/advisories/30742	Vendor Advisory
http://secunia.com/advisories/30895	Vendor Advisory
http://secunia.com/advisories/31262	Vendor Advisory
http://secunia.com/advisories/31287	Vendor Advisory
http://secunia.com/advisories/33937	Vendor Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740
http://support.apple.com/kb/HT3438
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0235
http://www.fetchmail.info/fetchmail-SA-2008-01.txt
http://www.mandriva.com/security/advisories?name=MDVSA-2008:117
http://www.openwall.com/lists/oss-security/2008/06/13/1
http://www.openwall.com/lists/oss-security/2021/08/09/1
http://www.securityfocus.com/archive/1/493391/100/0/threaded
http://www.securityfocus.com/archive/1/494865/100/0/threaded
http://www.securityfocus.com/bid/29705
http://www.securitytracker.com/id?1020298
http://www.vupen.com/english/advisories/2008/1860/references
http://www.vupen.com/english/advisories/2009/0422
https://bugzilla.novell.com/show_bug.cgi?id=354291
https://exchange.xforce.ibmcloud.com/vulnerabilities/43121
https://issues.rpath.com/browse/RPL-2623
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10950
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01091.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01095.html

URL

タグ

http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html

http://secunia.com/advisories/30742

Vendor Advisory

http://secunia.com/advisories/30895

Vendor Advisory

http://secunia.com/advisories/31262

Vendor Advisory

http://secunia.com/advisories/31287

Vendor Advisory

http://secunia.com/advisories/33937