ALT Linux Bugzilla – #22890

In verbose mode, fetchmail prints X.509 certificate subject and issuer
information to the user, and counts and allocates a malloc() buffer for
that purpose.

If the material to be displayed contains characters with high bit set
and the platform treats the "char" type as signed, this can cause a heap
buffer overrun because non-printing characters are escaped as
\xFF..FFnn, where nn is 80..FF in hex.

This might be exploitable to inject code if
- fetchmail is run in verbose mode
AND
- the host running fetchmail considers char unsigned
AND
- the server uses malicious certificates with non-printing characters
  that have the high bit set
AND
- these certificates manage to inject shell-code that consists purely of
  printable characters.

It is believed to be difficult to achieve all this.