public inbox for development@lists.ipfire.org
 help / color / mirror / Atom feed
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Cc: Adolf Belka <adolf.belka@ipfire.org>
Subject: [PATCH] fetchmail: Update to version 6.6.9
Date: Wed,  7 Oct 2026 12:56:54 +0200	[thread overview]
Message-ID: <20261007105658.104404-6-adolf.belka@ipfire.org> (raw)
In-Reply-To: <20261007105658.104404-1-adolf.belka@ipfire.org>

- Update from version 6.6.7 to 6.6.9
- No change in rootfile
- Changelog
6.6.9
 BUGFIXES:
	* When fetchmail was built with NTLM support, and a POP3 server send
	  a malformed challenge to the authentication request,
	  fetchmail would call strtok() on an uninitialized stack buffer and
	  could in extreme cases read off the end of the buffer if it did not
	  contain 0x00 or 0x20 bytes, and corrupt the first 0x20 character to 0x00.
	  This will not allow remote code injection but can cause undefined
	  behavior including crashes of fetchmail or corrupting one bit of memory.
	  This is a regression introduced by commit 09f95921 that also became
	  part of all fetchmail-6.6.7.rc1 and later release candidates and the
	  6.6.7 and 6.6.8 releases. It is separate from CVE-2026-94184 and
	  just happened to be introduced anew in the same releases that fixed
	  the mentioned CVE.
	  Reported by Jakub Kulik, Gitlab Issue #98.
	* Fix missing CR when sending multi-line warning messages from
	  daemon mode. Reported by Andrea Venturoli, Gitlab Issue #99.
6.6.8
 SECURITY ADVISORY:
	* fetchmail 6.6.8 updates the NEWS file (which you appear to be reading)
	  and the fetchmail-SA-2026-01 security announcement.  There are no code
	  changes since 6.6.7, but we need to prominently get the new documentation
	  out.  fetchmail-SA-2026-01 has been assigned CVE Id CVE-2026-94184.
 BUGFIX:
	* The Serbian (sr) translation was not installed due to an oversight in the
	  po/LINGUAS file.
 DEVELOPER-FACING CHANGE:
	* The "make check-git" target in the autotools build is more verbose
	  in case it errors out, usually due to uncommitted changes in the local
	  checkout.
 TRANSLATION UPDATES were contributed by these fine people - thank you!
	Please welcome the new traditional Chinese <zh_TW> translation!  非常感謝!
	* zh_TW: Alang Hsu [Chinese (traditional)]
	* sr:    Мирослав Николић [Serbian]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/fetchmail | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/fetchmail b/lfs/fetchmail
index 6d9c4c2d5..2c1e27f3d 100644
--- a/lfs/fetchmail
+++ b/lfs/fetchmail
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = Full-Featured POP and IMAP Mail Retrieval Daemon
 
-VER        = 6.6.7
+VER        = 6.6.9
 
 THISAPP    = fetchmail-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = fetchmail
-PAK_VER    = 27
+PAK_VER    = 28
 
 DEPS       =
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5c0a974b67e4c3392ab4de2b14eb5e34a0bff8eac48d2a5f412bfb500333df601e563d41dc26b897534a705c253222d13eb16e23dbefd0f82e945ae94cbf66ba
+$(DL_FILE)_BLAKE2 = 5477413b3b90ebf90e33893e942f6c79e9995f7ed3578c05a15ed980b9aae1464b7674eebabfe63d50688e12a38a92b2a85a83a1a94b94b3b269a26945de3567
 
 install : $(TARGET)
 
-- 
2.55.0



  parent reply	other threads:[~2026-10-07 10:57 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-07 10:56 [PATCH] bird: Update to version 3.3.3 Adolf Belka
2026-10-07 10:56 ` [PATCH] borgbackup: patch forgotten in 1.4.5 update Adolf Belka
2026-10-07 10:56 ` [PATCH] borgbackup: Update to version 1.4.5 Adolf Belka
2026-10-07 10:56 ` [PATCH] cifs-utils: Update to version 7.8 Adolf Belka
2026-10-07 10:56 ` [PATCH] expat: Update to version 2.9.0 Adolf Belka
2026-10-07 10:56 ` Adolf Belka [this message]
2026-10-07 10:56 ` [PATCH] harfbuzz: Update to version 14.5.1 Adolf Belka
2026-10-07 10:56 ` [PATCH] lvm2: Update to version 2.03.43 Adolf Belka
2026-10-07 10:56 ` [PATCH] python3-msgpack: Update to version 1.2.1 Adolf Belka

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261007105658.104404-6-adolf.belka@ipfire.org \
    --to=adolf.belka@ipfire.org \
    --cc=development@lists.ipfire.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox