{"id":"USN-9013-1","summary":"fetchmail vulnerabilities","details":"Christian Herdtweck discovered that Fetchmail incorrectly handled certain\nlong log messages. A remote attacker could possibly use this issue to cause\nFetchmail to crash, resulting in a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-36386)\n\nIt was discovered that the Fetchmail SMTP client incorrectly handled\ncertain status code messages. An attacker controlling a malicious server\ncould possibly use this issue to cause Fetchmail to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, and Ubuntu 20.04 LTS. (CVE-2025-61962)\n\nTristan Madani discovered that Fetchmail incorrectly handled certain NTLM\nauthentication challenges. A remote attacker could possibly use this issue\nto cause Fetchmail to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. The default compiler options for affected releases\nshould reduce the vulnerability to a denial of service. (CVE-2026-94184)","modified":"2026-11-10T02:58:35.291801848Z","published":"2026-11-09T17:17:55Z","upstream":["CVE-2021-36386","CVE-2025-61962","CVE-2026-94184","UBUNTU-CVE-2021-36386","UBUNTU-CVE-2025-61962","UBUNTU-CVE-2026-94184"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-9013-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-36386"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-61962"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-94184"}],"affected":[{"package":{"name":"fetchmail","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-2ubuntu0.1~esm1"}]}],"versions":["6.3.26-1","6.3.26-2"],"ecosystem_specific":{"binaries":[{"binary_version":"6.3.26-2ubuntu0.1~esm1","binary_name":"fetchmail"},{"binary_name":"fetchmailconf","binary_version":"6.3.26-2ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:16.04:LTS"}}},{"package":{"name":"fetchmail","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-3ubuntu0.1~18.04.1+esm1"}]}],"versions":["6.3.26-3","6.3.26-3build1","6.3.26-3ubuntu0.1~18.04.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_version":"6.3.26-3ubuntu0.1~18.04.1+esm1","binary_name":"fetchmail"},{"binary_name":"fetchmailconf","binary_version":"6.3.26-3ubuntu0.1~18.04.1+esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json"}},{"package":{"name":"fetchmail","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2ubuntu0.1~esm1"}]}],"versions":["6.4.0~rc4-1ubuntu1","6.4.1-1ubuntu1","6.4.2-2"],"ecosystem_specific":{"binaries":[{"binary_name":"fetchmail","binary_version":"6.4.2-2ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json"}},{"package":{"name":"fetchmail","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.27-1ubuntu0.2"}]}],"versions":["6.4.22-1","6.4.23-1","6.4.24-1","6.4.25-1","6.4.26-1","6.4.27-1","6.4.27-1ubuntu0.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"fetchmail","binary_version":"6.4.27-1ubuntu0.2"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json"}},{"package":{"name":"fetchmail","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.38-1ubuntu4.2"}]}],"versions":["6.4.37-1","6.4.38-1ubuntu1","6.4.38-1ubuntu3","6.4.38-1ubuntu4","6.4.38-1ubuntu4.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"6.4.38-1ubuntu4.2","binary_name":"fetchmail"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json"}},{"package":{"name":"fetchmail","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.6-1ubuntu0.1"}]}],"versions":["6.6.2-2","6.6.3-3","6.6.6-1","6.6.6-1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"6.6.6-1ubuntu0.1","binary_name":"fetchmail"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json","cves_map":{"ecosystem":"Ubuntu:26.10","cves":[]}}},{"package":{"name":"fetchmail","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/fetchmail?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-2ubuntu0.1"}]}],"versions":["6.5.4-0ubuntu2","6.5.4-0ubuntu3","6.6.2-2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"6.6.2-2ubuntu0.1","binary_name":"fetchmail"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:26.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9013-1.json"}}],"schema_version":"1.9.2"}