USN-9013-1: fetchmail vulnerabilities
Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-36386)
It was discovered that the Fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-61962)
Tristan Madani discovered that Fetchmail incorrectly handled certain NTLM authentication challenges. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2026-94184)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.3.26-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.3.26-3ubuntu0.1~18.04.1+esm1 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.4.2-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.4.27-1ubuntu0.2 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.4.38-1ubuntu4.2 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.6.6-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.6.2-2ubuntu0.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Ubuntu releases are affected by the long log message and SMTP status code issues?
CVE-2021-36386 and CVE-2025-61962 affect Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS only.
What access or attacker position is needed to trigger these flaws?
For CVE-2021-36386, a remote attacker can send certain long log messages. CVE-2025-61962 requires an attacker to control a malicious server, while CVE-2026-94184 involves a remote attacker providing certain NTLM authentication challenges.
Is arbitrary code execution expected under the default Ubuntu build configuration?
CVE-2026-94184 may allow arbitrary code execution, but the default compiler options on affected releases should reduce its impact to denial of service.