CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

Security fix for the ALT Linux 6 package fetchmail version 6.3.6-alt1

Jan. 8, 2007 Michael Shigorin 6.3.6-alt1 - 6.3.6: minor security update CVE-2006-5867, CVE-2006-5974 - replaced Debian menufile with Freedesktop one - spec macro abuse cleanup - NB: added Packager: but I don't use fetchmail for quite a while...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...