Ubuntu alert USN-7838-1 (fetchmail)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7838-1] fetchmail vulnerability
Date:
             
 
Thu, 23 Oct 2025 18:48:52 +0000
Message-ID:
             
 
<E1vC0Mm-00043G-LR@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7838-1
October 23, 2025

fetchmail vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

fetchmail could be made to crash if it received specially crafted network
traffic.

Software Description:
- fetchmail: SSL enabled POP3, APOP, IMAP mail gatherer/forwarder

Details:

It was discovered that the fetchmail SMTP client incorrectly handled
certain status code messages. An attacker controlling a malicious server
could possibly use this issue to cause fetchmail to crash, resulting in a
denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  fetchmail                       6.4.39-1ubuntu0.1

Ubuntu 24.04 LTS
  fetchmail                       6.4.38-1ubuntu4.1

Ubuntu 22.04 LTS
  fetchmail                       6.4.27-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7838-1
  CVE-2025-61962

Package Information:
  https://launchpad.net/ubuntu/+source/fetchmail/6.4.39-1ub...
  https://launchpad.net/ubuntu/+source/fetchmail/6.4.38-1ub...
  https://launchpad.net/ubuntu/+source/fetchmail/6.4.27-1ub...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmj6eHsACgkQcpJm3tlz
hgF40RAAvM7ZiOO/JBPNROaXX8nSzm49xrpkWGIBUuK+rqP9voxElF3xWNKCBLgY
cEmZapGdQxHX7rAZ/RfDr5EwLpTdvBfBNf87cMrVE4L2yKqdajOHsWcZTT/8oM5K
x3bhHBr7MHNKxTECKjVHYYlYcqh3gm9JbW6vPyHf4y6XJtDg6TM8FZUfWI/KVdiE
PVTPB7HtcVkU/0aGc7KjUqG0nvERChDHNRF4gGTnUyh04ibXIETAMf0zH5yc3ulp
Jc5pOzssz3fTyMftBs6z0Q7Mp5D4yrW2lZg0QleXY8WsBDb23q6wcb4oKcKrzCT3
q0AP8NjU8Q6Th3ImYLFnhMFmYEKL+CLdLxJ4UUzNN1NoaJ2XN9N+5TJ1KwjVmNK2
AW7BwcthjhBwfYcfRqtbKoDvA8iMN1btLLw0RUQdhkX/EhviepdsC56F6WwMcbJt
szQzKR8I1WzUawwVDCB5JETEUn3JadaXQ3p7NeBy7OBhTMUMqErjDfnF+ubx8ygY
Pnv/rcHDQRMqB4jQxm92JUd3HT2XkcJFq+6F7m+c36+GwsNWSRcjz4Yq/tmUyRiR
O6l1WMzP3TAr9X9PGCMvgj34yTI8RU1HhkDoM8U8xCckpsL4F9GKjKsaEWx7ObJ5
3U4T4WaDnNlmQ8Wmd/DxeVdEFSRmQqpBxv4iDeTb06HGL4ioTcw=
=ggVm
-----END PGP SIGNATURE-----