Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long USER command containing \%s\ sequences to the pop3 port (110/tcp) which are expanded to \%%s\ before being used in the memmove function possibly due to an incomplete fix for CVE-2001-1078.