Description
Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fetchmail | 6.2.5-16 | — |
| Debian 13 | fetchmail | 6.2.5-16 | — |
| Debian 12 | fetchmail | 6.2.5-16 | — |
| Debian 3.1 | fetchmail | 6.2.5-12sarge1 | DSA-774-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | fetchmail | 6.2.5-6.el4.2 | RHSA-2005:640 |
| RHEL 3 | fetchmail | 6.2.0-3.el3.2 | RHSA-2005:640 |
Advisories 2
- RHSA-2005:640 Red Hat Security Advisory: fetchmail security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-774-1 fetchmail - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- APPLE-SA-2006-08-01 vendor-advisory
- 14349 vdb-entry
- SUSE-SR:2005:018 vendor-advisory
- ADV-2006-3101 vdb-entry
- http://www.redhat.com/archives/fedora-announce-list/2005-July/msg00104.html
- ADV-2005-1171 vdb-entry
- 21253 third-party-advisory
- 19289 vdb-entry
- http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt
- 18174 vdb-entry
- TA06-214A third-party-advisory
- oval:org.mitre.oval:def:1124 vdb-entry signature
- FEDORA-2005-613 vendor-advisory
- oval:org.mitre.oval:def:1038 vdb-entry signature
- http://developer.berlios.de/project/shownotes.php?release_id=6617
- 20060801 DMA[2006-0801a] - 'Apple OSX fetchmail buffer overflow' mailing-list
- oval:org.mitre.oval:def:8833 vdb-entry signature
- DSA-774 vendor-advisory
- RHSA-2005:640 vendor-advisory
- FEDORA-2005-614 vendor-advisory
- 20060526 rPSA-2006-0084-1 fetchmail mailing-list
- 16176 third-party-advisory