{"id":"CVE-2021-36386","aliases":["ALPINE-CVE-2021-36386","ALSA-2022:1964","AZL-7226","DEBIAN-CVE-2021-36386","EUVD-2021-23001","GHSA-rr6c-95pp-cpgf","MGASA-2021-0391","OESA-2021-1314","RHSA-2022:1964","RLSA-2022:1964","SUSE-SU-2021:2771-1","SUSE-SU-2021:2791-1","SUSE-SU-2021:4018-1","SUSE-SU-2024:3006-1","UBUNTU-CVE-2021-36386","USN-9013-1","openSUSE-SU-2021:1183-1","openSUSE-SU-2021:1591-1","openSUSE-SU-2021:2791-1","openSUSE-SU-2021:4018-1","openSUSE-SU-2024:10753-1"],"status":"published","title":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the...","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0256,"percentile":0.85298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-909"],"published":"2021-07-29T13:59:24Z","modified":"2026-11-11T09:36:58Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"fetchmail","fixed_in":["6.4.20-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"fetchmail","fixed_in":["6.4.22-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fetchmail","fixed_in":["6.4.16-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fetchmail","fixed_in":["6.4.16-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fetchmail","fixed_in":["6.4.16-4"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"fetchmail","fixed_in":["6.4.8-4.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"fetchmail","fixed_in":["6.4.20-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"fetchmail","fixed_in":["6.4.20-1.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"fetchmail","fixed_in":["6.3.26-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"fetchmail","fixed_in":["6.3.26-13.12.1","6.3.26-13.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"fetchmail","fixed_in":["6.3.26-13.12.1","6.3.26-13.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","fixed_in":["6.3.26-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","fixed_in":["6.3.26-3ubuntu0.1~18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","fixed_in":["6.4.2-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"fetchmail","fixed_in":["6.3.26-lp152.6.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"fetchmail","fixed_in":["6.3.26-20.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.16-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.16-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.16-4"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.8-4.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.20-1.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fetchmail-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fetchmail-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-2ubuntu0.1~esm1"}]}],"versions":["6.3.26-1","6.3.26-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-3ubuntu0.1~18.04.1+esm1"}]}],"versions":["6.3.26-3","6.3.26-3build1","6.3.26-3ubuntu0.1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2ubuntu0.1~esm1"}]}],"versions":["6.4.0~rc4-1ubuntu1","6.4.1-1ubuntu1","6.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-2ubuntu0.1~esm1"}]}],"versions":["6.3.26-1","6.3.26-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-3ubuntu0.1~18.04.1+esm1"}]}],"versions":["6.3.26-3","6.3.26-3build1","6.3.26-3ubuntu0.1~18.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2ubuntu0.1~esm1"}]}],"versions":["6.4.0~rc4-1ubuntu1","6.4.1-1ubuntu1","6.4.2-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.27-1ubuntu0.2"}]}],"versions":["6.4.22-1","6.4.23-1","6.4.24-1","6.4.25-1","6.4.26-1","6.4.27-1","6.4.27-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.38-1ubuntu4.2"}]}],"versions":["6.4.37-1","6.4.38-1ubuntu1","6.4.38-1ubuntu3","6.4.38-1ubuntu4","6.4.38-1ubuntu4.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.6-1ubuntu0.1"}]}],"versions":["6.6.2-2","6.6.3-3","6.6.6-1","6.6.6-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-2ubuntu0.1"}]}],"versions":["6.5.4-0ubuntu2","6.5.4-0ubuntu3","6.6.2-2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-lp152.6.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-lp152.6.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.21-2.1"}]}],"bundled":6}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fetchmail","product":"fetchmail"}],"references":[{"url":"https://www.fetchmail.info/security.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/07/28/5","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://www.fetchmail.info/fetchmail-SA-2021-01.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/08/09/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIXKO6QW3AUHGJVWKJXBCOVBYJUJRBFC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202209-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36386","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIXKO6QW3AUHGJVWKJXBCOVBYJUJRBFC/"},{"url":"https://github.com/advisories/GHSA-rr6c-95pp-cpgf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-36386","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1964.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-36386","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-39272","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-36386","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0391.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29297","tags":["report"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1314","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1964","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1987766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999190","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1964.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36386","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39272","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1964","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1033081","tags":["report"]},{"url":"https://bugzilla.suse.com/1182807","tags":["report"]},{"url":"https://bugzilla.suse.com/1188034","tags":["report"]},{"url":"https://bugzilla.suse.com/1188875","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36386","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212791-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214018-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152964","tags":["report"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1190069","tags":["report"]},{"url":"https://bugzilla.suse.com/1190896","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39272","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243006-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36386","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9013-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-61962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94184","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/467HBFXGJJT2G2NY45XULNMMNRQKSY46/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2MQSBOFKUN3D2SAYKHGH2NQW7UGR6J7P/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WMV7EBXEZS74TUNOO7AISIYY6S7T7TDO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZEYREAP5E4PNL4UXB7R6OYSFSQ5VNFHB/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4565","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-36386","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-29T13:59:24Z","modified":"2024-08-04T00:54:51.476Z","updated_at":"2026-11-02T14:33:05.989686Z"}],"euvd":[{"id":"EUVD-2021-23001","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-29T13:59:24Z","modified":"2024-08-04T00:54:51Z","updated_at":"2026-11-03T03:24:29.877227Z"}],"ghsa":[{"id":"GHSA-rr6c-95pp-cpgf","title":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the...","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2022-05-24T19:09:22Z","modified":"2023-02-02T05:05:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-909"],"updated_at":"2026-11-02T14:52:02.518349Z"}],"nvd":[{"id":"CVE-2021-36386","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-30T14:15:18.14Z","modified":"2026-06-17T03:58:47.22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"ALPINE-CVE-2021-36386","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-30T14:15:18.14Z","modified":"2026-11-03T06:31:36.584337874Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"AZL-7226","title":"CVE-2021-36386 affecting package fetchmail for versions less than 6.4.22-1","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-30T14:15:18Z","modified":"2026-04-21T04:36:42.349557Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-36386","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-30T14:15:18.14Z","modified":"2026-11-03T02:30:36.199925962Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:05:53.289262Z"},{"id":"DEBIAN-CVE-2021-36386","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-30T14:15:18.14Z","modified":"2026-10-23T18:03:16.16201089Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1314","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections.\r\n\r\nSecurity Fix(es):\r\n\r\nreport_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.(CVE-2021-36386)","status":"published","published":"2021-08-20T11:04:33Z","modified":"2026-08-18T01:15:56.493514942Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:1964","title":"Red Hat Security Advisory: fetchmail security update","status":"published","published":"2024-09-16T07:29:13Z","modified":"2025-11-22T12:33:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1964","title":"Moderate: fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.\n\nSecurity Fix(es):\n\n* fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)\n\n* fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:41:48Z","modified":"2026-02-04T23:45:04.954618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-36386","description":"report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.","status":"published","published":"2021-07-30T14:15:00Z","modified":"2026-11-11T09:36:58.241197552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T09:58:36.569374Z"},{"id":"ALSA-2022:1964","title":"Moderate: fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.\n\nSecurity Fix(es):\n\n* fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)\n\n* fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:41:48Z","modified":"2026-10-29T11:01:18.302979699Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2021-0391","title":"Updated fetchmail packages fix security vulnerability","description":"Updated fetchmail packages fix security vulnerability:\n\nreport_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits\ninitialization of the vsnprintf va_list argument, which might allow mail\nservers to cause a denial of service or possibly have unspecified other\nimpact via long error messages (CVE-2021-36386).\n","status":"published","published":"2021-08-06T09:33:48Z","modified":"2026-04-16T04:44:31.677325111Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1183-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875)\n- Change PASSWORDLEN from 64 to 256 (bsc#1188034)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-08-23T14:06:10Z","modified":"2026-02-04T03:11:03.099496Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1591-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).\n- CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).\n\n- Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)\n- Remove all python2 dependencies (bsc#1190896).\n- De-hardcode /usr/lib path for launch executable (bsc#1174075).\n- Added hardening to systemd service(s) (bsc#1181400).\n  \nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-12-17T11:06:33Z","modified":"2026-02-04T03:51:21.656624Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2791-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875)\n- Change PASSWORDLEN from 64 to 256 (bsc#1188034)\n","status":"published","published":"2021-08-20T08:14:37Z","modified":"2026-02-04T03:29:18.997681Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:4018-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).\n- CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).\n\n- Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)\n- Remove all python2 dependencies (bsc#1190896).\n- De-hardcode /usr/lib path for launch executable (bsc#1174075).\n- Added hardening to systemd service(s) (bsc#1181400).\n  ","status":"published","published":"2021-12-14T07:58:47Z","modified":"2026-02-04T02:17:39.577669Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10753-1","title":"fetchmail-6.4.21-2.1 on GA media","description":"These are all security issues fixed in the fetchmail-6.4.21-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:17.929848Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:2771-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: DoS or information disclosure in some configurations (bsc#1188875)\n- Change PASSWORDLEN from 64 to 256 [bsc#1188034]\n- Set the hostname for SNI when using TLS [bsc#1182807]\n- Allow --syslog option in daemon mode. (bsc#1033081)\n- Set the hostname for SNI when using TLS. (bsc#1182807)\n- Change PASSWORDLEN from 64 to 256 (bsc#1188034)\n","status":"published","published":"2021-08-18T07:46:01Z","modified":"2026-02-04T02:19:59.078506Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2791-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875)\n- Change PASSWORDLEN from 64 to 256 (bsc#1188034)\n","status":"published","published":"2021-08-20T08:15:11Z","modified":"2026-02-04T04:32:49.852469Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:4018-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).\n- CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).\n\n- Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)\n- Remove all python2 dependencies (bsc#1190896).\n- De-hardcode /usr/lib path for launch executable (bsc#1174075).\n- Added hardening to systemd service(s) (bsc#1181400).\n  ","status":"published","published":"2021-12-14T07:59:15Z","modified":"2026-02-04T02:54:54.665426Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2024:3006-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- Fixed regression in patch for CVE-2021-36386 (bsc#1224188)\n","status":"published","published":"2024-08-23T14:46:48Z","modified":"2026-02-04T02:26:44.202329Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-9013-1","title":"fetchmail vulnerabilities","description":"Christian Herdtweck discovered that Fetchmail incorrectly handled certain\nlong log messages. A remote attacker could possibly use this issue to cause\nFetchmail to crash, resulting in a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-36386)\n\nIt was discovered that the Fetchmail SMTP client incorrectly handled\ncertain status code messages. An attacker controlling a malicious server\ncould possibly use this issue to cause Fetchmail to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, and Ubuntu 20.04 LTS. (CVE-2025-61962)\n\nTristan Madani discovered that Fetchmail incorrectly handled certain NTLM\nauthentication challenges. A remote attacker could possibly use this issue\nto cause Fetchmail to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. The default compiler options for affected releases\nshould reduce the vulnerability to a denial of service. (CVE-2026-94184)","status":"published","published":"2026-11-09T17:17:55Z","modified":"2026-11-11T09:34:56.351462059Z","updated_at":"2026-11-10T03:21:46.325253Z"}]}}