Description
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fetchmail | 6.1.0-1 | — |
| Debian 13 | fetchmail | 6.1.0-1 | — |
| Debian 12 | fetchmail | 6.1.0-1 | — |
| Debian 3.0 | fetchmail +1 | 5.9.11-6.1 | DSA-171 |
Advisories 1
- DSA-171 fetchmail - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2002:063 vendor-advisory
- 5827 vdb-entry
- 20020929 Advisory 03/2002: Fetchmail remote vulnerabilities mailing-list
- 5825 vdb-entry
- RHSA-2002:215 vendor-advisory
- fetchmail-multidrop-bo(10203) vdb-entry
- CLA-2002:531 vendor-advisory
- ESA-20021003-023 vendor-advisory
- DSA-171 vendor-advisory