Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fetchmail for openSUSE:Factory checked in at 2026-10-13 17:48:38 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fetchmail (Old) and /work/SRC/openSUSE:Factory/.fetchmail.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "fetchmail" Tue Oct 13 17:48:38 2026 rev:123 rq:1384545 version:6.6.8 Changes: -------- --- /work/SRC/openSUSE:Factory/fetchmail/fetchmail.changes 2026-05-12 19:31:31.671170372 +0200 +++ /work/SRC/openSUSE:Factory/.fetchmail.new.3698736/fetchmail.changes 2026-10-13 17:48:39.822660415 +0200 @@ -1,0 +2,44 @@ +Mon Oct 5 10:29:41 UTC 2026 - Ana Guerrero <[email protected]> + +- Update Source URL + +------------------------------------------------------------------- +Wed Sep 30 11:26:26 UTC 2026 - Angel Yankov <[email protected]> + +- Update to 6.6.8 + * fetchmail 6.6.8 updates the NEWS file (which you appear to be reading) + and the fetchmail-SA-2026-01 security announcement. There are no code + changes since 6.6.7, but we need to prominently get the new documentation + out. fetchmail-SA-2026-01 has been assigned CVE Id CVE-2026-94184. + * The Serbian (sr) translation was not installed due to an oversight in the + po/LINGUAS file. + +* CVE-2026-94184: Safeguard internal NTLM buffer handling to avoid a stack + buffer overrun if server sends extremely long fields in the challenge. + Reported by Tristan Madani, who also pointed out that compilers are free + to reorder variables on the stack. +* The IMAP protocol exchange was made stricter, + (1) it will validate tagged responses that we received the right + response to make sure fetchmail and the IMAP server are still in synch, + (2) it will no longer accept the response words OK, NO, BAD, BYE if + there is trailing garbage, and will now reject "OKAY" or "NONE", which + would previously be accepted as aliases for OK or NO. + +* Handling of escape sequences in the rcfile has been bugfixed to handle + all ISO C escape sequences, and handle octal escapes more strictly. +* The IMAP client, which has always used message indexes for the selected + mailbox, did not abort when receiving an EXPUNGE response - which changes + message numbers inside the mailbox. Unlike UIDs, the message numbers are + not stable and fetchmail does not have internal interfaces to track which + messages are deleted, and adding those to a 6.6.X release would be too + risky, and switching to UID is also too big a change, so we have no + choice but to abort the session when seeing an EXPUNGE response without + our own EXPUNGE request, to avoid marking the wrong message as seen/deleted + or skip the wrong one, or assume the wrong message size. + Earl Chew reported this versus Yahoo Mail via Gitlab Work Item #91, which + automatically expunges messages that are marked with the \Deleted flag. + + +For a full changelog, visit https://www.fetchmail.info/index.html + +------------------------------------------------------------------- Old: ---- fetchmail-6.6.1.tar.xz fetchmail-6.6.1.tar.xz.asc New: ---- fetchmail-6.6.8.tar.xz fetchmail-6.6.8.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fetchmail.spec ++++++ --- /var/tmp/diff_new_pack.IuOkRj/_old 2026-10-13 17:48:41.953749746 +0200 +++ /var/tmp/diff_new_pack.IuOkRj/_new 2026-10-13 17:48:41.955749830 +0200 @@ -21,13 +21,13 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: fetchmail -Version: 6.6.1 +Version: 6.6.8 Release: 0 Summary: Full-Featured POP and IMAP Mail Retrieval Daemon License: GPL-2.0-or-later URL: https://www.fetchmail.info/ -Source0: https://sourceforge.net/projects/%{name}/files/branch_6.5/%{name}-%{version}.tar.xz -Source1: https://sourceforge.net/projects/%{name}/files/branch_6.5/%{name}-%{version}.tar.xz.asc +Source0: https://sourceforge.net/projects/%{name}/files/branch_6.6/%{name}-%{version}.tar.xz +Source1: https://sourceforge.net/projects/%{name}/files/branch_6.6/%{name}-%{version}.tar.xz.asc Source2: %{name}.logrotate Source3: sysconfig.%{name} Source5: %{name}.keyring ++++++ fetchmail-6.6.1.tar.xz -> fetchmail-6.6.8.tar.xz ++++++ ++++ 68915 lines of diff (skipped)
