Source: fetchmail Version: 6.6.6-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for fetchmail. CVE-2026-94184[0]: | A stack-based buffer overflow flaw was found in fetchmail when built | with NTLM support. A malicious or compromised mail server | advertising NTLM authentication can send a crafted Type 2 challenge | that causes fetchmail to write past a fixed stack buffer while | building the NTLM authenticate response. This may lead to remote | code execution depending on stack-frame layout, or to authentication | failure or process termination under memory hardening. Affects | v5.0.8 through v6.6.6. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-94184 https://www.cve.org/CVERecord?id=CVE-2026-94184 [1] https://www.fetchmail.info/fetchmail-SA-2026-01.txt [2] https://gitlab.com/fetchmail/fetchmail/-/commit/cb5be5c38471eec19e519ace0bc569176317ea92 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
