CVE-2025-61962

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.

Security Fix(es):

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.

Security Fix(es):

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.

Security Fix(es):

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.

Security Fix(es):

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.

Security Fix(es):

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.

Security Fix(es):

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

It was discovered that fetchmail's SMTP client, when configured to authenticate, is susceptible to a protocol violation where, when a trusted but malicious or malfunctioning SMTP server responds to an authentication request with a "334" code but without a following blank on the line, it will attempt to start reading from memory address 0x1 to parse the server's SASL challenge. This event will usually cause a crash of fetchmail (CVE-2025-61962).

These are all security issues fixed in the fetchmail-6.5.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for fetchmail fixes the following issues:

• CVE-2025-61962: Fixed denial of service (bsc#1251194)

This update for fetchmail fixes the following issues:

• CVE-2025-61962: fixed a denial of service condition (bsc#1251194)

This update for fetchmail fixes the following issues:

• CVE-2025-61962: fixed a denial of service condition (bsc#1251194)

This update for fetchmail fixes the following issues:

• CVE-2025-61962: Fixed denial of service (bsc#1251194)

It was discovered that the fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause fetchmail to crash, resulting in a denial of service.