Description
sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fetchmail | 6.3.8-8 | — |
| Debian 13 | fetchmail | 6.3.8-8 | — |
| Debian 12 | fetchmail | 6.3.8-8 | — |
| Debian 4.0 | fetchmail | 6.3.6-1etch1 | DSA-1377-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | fetchmail | 6.3.6-1.1.el5_3.1 | RHSA-2009:1427 |
| RHEL 4 | fetchmail | 6.2.5-6.0.1.el4_8.1 | RHSA-2009:1427 |
| RHEL 3 | fetchmail | 6.2.0-3.el3.5 | RHSA-2009:1427 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | fetchmail | 6.4.21-2.1 | openSUSE-SU-2024:10753-1 |
Advisories 3
- RHSA-2009:1427 Red Hat Security Advisory: fetchmail security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1377-2 fetchmail - null pointer dereference Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10753-1 fetchmail-6.4.21-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 33937 third-party-advisory
- 3074 third-party-advisory
- http://fetchmail.berlios.de/fetchmail-SA-2007-02.txt
- http://mknod.org/svn/fetchmail/branches/BRANCH_6-3/fetchmail-SA-2007-02.txt
- http://support.apple.com/kb/HT3438
- 1018627 vdb-entry
- APPLE-SA-2009-02-12 vendor-advisory
- 20080617 fetchmail security announcement fetchmail-SA-2007-02 (CVE-2007-4565) mailing-list
- 2007-0028 vendor-advisory
- oval:org.mitre.oval:def:10528 vdb-entry signature
- 25495 vdb-entry
- ADV-2007-3032 vdb-entry
- ADV-2009-0422 vdb-entry
- 20070907 FLEA-2007-0053-1 fetchmail mailing-list
- 27399 third-party-advisory
- fetchmail-warning-dos(36385) vdb-entry
- DSA-1377 vendor-advisory
- MDKSA-2007:179 vendor-advisory
- https://issues.rpath.com/browse/RPL-1690
- USN-520-1 vendor-advisory
- SUSE-SR:2007:022 vendor-advisory
- 45833 vdb-entry