This page last updated 2010-02-24.

Mirror of the official fetchmail website

Click here to go to the mirror of the official fetchmail website.

Fetchmail security information

2010-02-05 CVE-2010-0562: heap corruption with characters >0x80 in verbose mode when printing SSL/TLS X.509 certificates on platforms with signed characters.
2009-08-06 CVE-2009-2666: SSL/TLS improper validation of certificates with NUL prefixes (fixed in 6.3.11).
2008-06-17 CVE-2008-2711: Denial of Service on long headers in -v -v verbose mode (fixed in 6.3.9-rc2).
2007-08-28 CVE-2007-4565: Denial of Service when a locally-generated warning message is rejected (fixed in 6.3.9-rc1).
2007-04-06 CVE-2007-1558: APOP considered insecure, fetchmail implementation too lax (strengthened in 6.3.8)
2007-01-04 CVE-2006-5974: crash when refusing message with --mda delivery (new in 6.3.5, fixed in 6.3.6)
2007-02-18 REVISED: 2007-01-04 CVE-2006-5867: password disclosure (long-standing, fixed in 6.3.6)
2006-01-22 CVE-2006-0321: denial of service when bouncing bad addresses in 6.3.0 and 6.3.1 (fixed in 6.3.2)
2006-01-22 fetchmail 6.2.X was discontinued at this point, it is known since late 2006 to be vulnerable to CVE-2006-5867 above.
2005-12-19 CVE-2005-4348: denial of service in multidrop mode in 6.2.5.X before 6.2.5.5 and in 6.3.0 (fixed in 6.2.5.5 and 6.3.1)
2005-11-30 fetchmail 6.3.0 was released
2005-10-21 CVE-2005-3088: password exposure in fetchmailconf before 6.2.5.4
2005-07-21 CVE-2005-2335: remote root in fetchmail before 6.2.5.2

Fetchmail 6.3.15-beta2 test version

new 2010-02-26
fetchmail-6.3.15-beta1.tar.bz2 * GnuPG signature (detached ASCII armor)
Changes in 6.3.15-beta2 since 6.3.14

Please report all troubles you find in this version to the fetchmail-devel@lists.berlios.de mailing list.

As any free software, this comes without warranty - use at your own risk!

Fetchmail 6.3.14 release

new 2010-02-05:
fetchmail-6.3.14.tar.bz2 * GnuPG signature
fetchmail-6.3.14.tar.xz * GnuPG signature
changes since 6.0.0

As any free software, this comes without warranty - use at your own risk!

Fetchmail patches

This web site collects a few older patches on top of fetchmail package. If used, they must be applied in order shown, on top of fetchmail 6.2.5

Sunil Shetye's feature patch: fetchmail-6.2.5-ss1.patch
My bugfix patch: fetchmail-6.2.5-ss1-ma3.patch

These patches add a new handling for UID files and improve UIDL handling for POP3 and IMAP, with Sunil's Fast UIDL mode that now works outside daemon mode as well. It will erase your old ~/.fetchids file on first run and save the UIDs to files in a ~/.fetchmail directory instead.

I also have a helper script to revert the new .fetchmail/*-* ID files to the old .fetchids format. It requires Perl and is named fetchmail-6.2.5-fetchids-revert.pl

Fetchmail Subversion archive

Fetchmail has been converted to a Git repository on 2010-02-06. I keep an archive of the former server-side Subversion repository as a ~10 MB .tar.xz file here:
fetchmail.svnrepo.backup.tar.xz * [GnuPG signature]

Matthias Andree