The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the fetchmail-6.4.24-1.el9 build changelog.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:4018-1 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:1964 advisory.

  - fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

  - fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0198 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-36386:
    report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user.

    CVE-2021-39272:
    Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3362:02 advisory.

    * fetchmail: DoS or information disclosure when logging long messages     (CVE-2021-36386)
      * fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3006-1 advisory.

    - Fixed regression in patch for CVE-2021-36386 (bsc#1224188)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-14 (Fetchmail: Multiple Vulnerabilities)

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1964 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the fetchmail package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthias Andree reports :

When a log message exceeds c. 2 kByte in size, for instance, with very long header contents, and depending on verbosity option, fetchmail can crash or misreport each first log message that requires a buffer reallocation.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1964 advisory.

    * fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

    * fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-9013-1 advisory.

    Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote     attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-36386)

    It was discovered that the Fetchmail SMTP client incorrectly handled certain status code messages. An     attacker controlling a malicious server could possibly use this issue to cause Fetchmail to crash,     resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu     20.04 LTS. (CVE-2025-61962)

    Tristan Madani discovered that Fetchmail incorrectly handled certain NTLM authentication challenges. A     remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of     service, or possibly execute arbitrary code. The default compiler options for affected releases should     reduce the vulnerability to a denial of service. (CVE-2026-94184)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
191318	CentOS 9 : fetchmail-6.4.24-1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
156154	openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:4018-1)	Nessus	SuSE Local Security Checks	2021/12/17	2021/12/17	medium
160955	CentOS 8 : fetchmail (CESA-2022:1964)	Nessus	CentOS Local Security Checks	2022/5/10	2022/5/10	medium
235980	Alibaba Cloud Linux 3 : 0198: fetchmail (ALINUX3-SA-2022:0198)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
294497	MiracleLinux 8 : fetchmail-6.4.24-1.el8.ML.1 (AXSA:2022-3362:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
206189	SUSE SLES12 Security Update : fetchmail (SUSE-SU-2024:3006-1)	Nessus	SuSE Local Security Checks	2024/8/25	2024/8/25	high
165440	GLSA-202209-14 : Fetchmail: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/9/25	2022/9/25	medium
184882	Rocky Linux 8 : fetchmail (RLSA-2022:1964)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
158274	EulerOS 2.0 SP3 : fetchmail (EulerOS-SA-2022-1162)	Nessus	Huawei Local Security Checks	2022/2/23	2022/2/23	high
152150	FreeBSD : fetchmail -- 6.4.19 and older denial of service or information disclosure (cbfd1874-efea-11eb-8fe9-036bd763ff35)	Nessus	FreeBSD Local Security Checks	2021/7/30	2021/8/11	high
357738	Rocky Linux 8 [CIQ] Security Update: fetchmail / fetchmail-debuginfo / fetchmail-debugsource Multiple Vulnerabilities (crlsa-2022_1964)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
378018	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Fetchmail vulnerabilities (USN-9013-1)	Nessus	Ubuntu Local Security Checks	2026/11/10	2026/11/14	high

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

high

medium

medium

high

high

medium

high