CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

mail/fetchmail 6.6.9

Batch mail retrieval utility for IMAP/POP3/ETRN/ODMR

Port info

Maintainer
chalpin@cs.wisc.edu
Packages
latest: 6.6.9
Upstream
up to date
Last update
to 6.6.9 · 14d62b999b
Quarterly
2026Q4: 6.6.9 · last MFH 48ef898280
Formerly
mail/fetchmail64 until 2019-09-28
WWW
https://www.fetchmail.info/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install fetchmail
installs 6.6.9 from latest; from quarterly (2026Q4) 6.6.9
Port
# cd /usr/ports/mail/fetchmail && make install clean
# make -C /usr/ports/mail/fetchmail config  # change options first
Size
544 KiB download · 2.2 MiB installed
Depends on
devel/gettext-runtime 1.0_1
License
GPLv2+
Creates
user fetchmail, group fetchmail
Options
5 of 10 on in the package: DOCS GSSAPI_BASE NLS OPENSSL RPA
Show the 5 options that are off
GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE OPIE WOLFSSL
pkg-message
Shown after installing
For pointers how to configure fetchmail in daemon mode
please consult /usr/local/etc/rc.d/fetchmail.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 166.6.96.6.9–
FreeBSD 156.6.96.6.9–
FreeBSD 146.6.96.6.96.6.9

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 156.6.96.6.9–
FreeBSD 146.6.96.6.96.6.9

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 6.6.9.

Fixed (23)

Show 23 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (376)

Bernard Spil (brnrd) · 6.3.26_4
mail/fetchmail: Fix build without SSLv3

- Fix build with OpenSSL 1.1 and LibreSSL
  - Stop using pkg-install/pkg-deinstall scripts
  - Use pkg-plist keywords
  - Use GSSAPI ports framework
  - Change X11, POP2 options to use options framework

PR:             210130
Submitted by:	freebsd-ports@charlieroot.de
Reviewed by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
Approved by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
0917233fb0
Matthias Andree (mandree) · 6.3.26_3
Disable SSLv2, to fix new/from-ports OpenSSL builds.

Newer and ports-based builds define the SSLv2_client_method() in the
headers unless OPENSSL_NO_SSL2, or, depending on version,
OPENSSL_NO_SSL2_METHOD is defined, however newer OpenSSL versions in
FreeBSD no longer provide the implementation in the library.

Preload the autoconf (configure) cache to pretend SSLv2_client_method()
were universally _un_available, effectively disabling SSLv2 altogether.

PR:		209596
Submitted by:	peter@ [first proposal], mandree@ [committed proposal]
Reported by:	peter@
Approved by:	chalpin@cs.wisc.edu (maintainer)
9f0bacf50c
Mathieu Arnold (mat) · 6.3.26_2
Remove ${PORTSDIR}/ from dependencies, categories m, n, o, and p.

With hat:	portmgr
Sponsored by:	Absolight
8d6597e0bb
Dmitry Marakasov (amdmi3) · 6.3.26_2
Improve shebangfix framework

- Support multiple values in *_OLD_CMD, i.e. we can now fix both "/usr/bin/python" and "/usr/bin/env python" at the same time
- Default *_OLD_CMD values are now always appended, so you don't need to specify them in individual ports
- Add lua support (depends on USES=lua)
- Add more default values, such as "/usr/bin/env foo" for python, perl, bash, ruby and lua
- Shebangfix now matches whole words, e.g. we will no longer (erroneously) replace "/usr/bin/perl5.005" with "${perl_CMD}5.005" (but "/usr/bin/perl -tt" is still (correctly) replaced with "${perl_CMD} -tt")

Note that *_OLD_CMD items containing spaces must now be quoted (e.g. perl_OLD_CMD=/bin/perl /usr/bin/perl "/usr/bin/env perl")

Update shebangfix usage according to new rules in many ports:

- Remove *_OLD_CMD for patterns now replaced by default
- Quote custom *_OLD_CMD which contain spaces

Fix shebangfix usage in many ports (irrelevant to infrastructure change):

- Remove redundant SHEBANG_LANG (no need to duplicate default langs)
- Remove redundant *_CMD (such as python_CMD=${LOCALBASE}/bin/python${PYTHON_VER} when USES=python is present)
- Never use *_OLD_CMD in REINPLACE_CMD matchers, these should always look for exact string

Approved by:	portmgr (bapt)
Differential Revision:	D3756
67971bd0fb
Dmitry Marakasov (amdmi3) · 6.3.26_2
- Switch to options helpers - Switch to @sample

Approved by:	portmgr blanket
d69a343aec
Dmitry Marakasov (amdmi3) · 6.3.26_2
- Correct python dependency to fix build with X11 enabled

PR:		201131
Submitted by:	lantw44@gmail.com
Approved by:	chalpin@cs.wisc.edu (maintainer)
b3be5eadcc
Dmitry Marakasov (amdmi3) · 6.3.26_2
- Add CPE info

Approved by:	portmgr blanket
21c66239b2
Matthias Andree (mandree) · 6.3.26_2
Update URLs that pointed to the defunct berlios.de site.
fb9ba05e24
Marcus von Appen (mva) · 6.3.26_1
- Convert ports of mail/ to new USES=python

Approved by:	portmgr (implicit)
306e66af5d
John Marino (marino) · 6.3.26_1
mail/fetchmail: Fix on F10 when system is built without Kerberos

PR:		191978
Submitted by:	Jeremy Chadwick
Approved by:	maintainer (Corey Halpin)
b2cc91b7be
Adam Weinberger (adamw) · 6.3.26_1
Add DOCS to OPTIONS_DEFINE to ports that check for PORT_OPTIONS:MDOCS.
99afccd1ce
Mathieu Arnold (mat) · 6.3.26_1
Remove the last @comment $FreeBSD$ from plists.

With hat:	portmgr
Sponsored by:	Absolight
cf28d260c6
Rene Ladan (rene) · 6.3.26_1
Fix typo in pkg-install.in and bump PORTREVISION

Submitted by:	Takefu <takefu@airport.fm>
cf9f93a285
Rene Ladan (rene) · 6.3.26
- Add license information [1] - Fix shebang for fetchmailconf.py [1] - Convert POP2 knob into an option [1] - Use option helpers [1] - Fix staging of documentation and X11 files [1] - Simplify post-install target and pkg-plist - Replace USE_GMAKE and USE_XZ by their USES equivalents - Do not display pkg-message in post-install - Do not create /var/run/fetchmail in pkg-plist

PR:		ports/185572 [1]
Submitted by:	Takefu <takefu@airport.fm>
Approved by:	maintainer timeout (<chalpin@cs.wisc.edu>)
0a060a4471
Baptiste Daroussin (bapt) · 6.3.26
Fix properties on pkg-plist
e04b632220
Baptiste Daroussin (bapt) · 6.3.26
Add NO_STAGE all over the place in preparation for the staging support (cat: mail)
fd61959c15
Alex Kozlov (ak) · 6.3.26
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Alex Kozlov (ak) · 6.3.26
- Convert USE_GETTEXT to USES (part 3)

Approved by:	portmgr (bapt)
e159824929
Matthias Andree (mandree) · 6.3.26
Upgrade to new version 6.3.26.

This fixes one data loss bug that causes the last line of a message to
be lost if it is unterminated (i. e. no LF character) and if the
"mimedecode" option is enabled (which defaults to "off").

PR:		ports/178092
Approved by:	Corey Halpin (maintainer)
92d82be9be
Matthias Andree (mandree) · 6.3.25
Update to new upstream release 6.3.25.

Adds Esperanto-language translation.

PR:		ports/177094
Approved by:	Corey Halpin (maintainer)
6876c1145f
Beech Rintoul (beech) · 6.3.24_1
- Update script for chasing _tkinter.so relocation

PR:		ports/176611
Submitted by:	Li-Wen Hsu <lwhsu@FreeBSD.org>
Approved by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
b67e674ac6
Matthias Andree (mandree) · 6.3.24
Fix up my patch error. Not bumping PORTREVISION because there is no functional change, the script has either replaced itself through exec, or exited.
d98e2b7249
Matthias Andree (mandree) · 6.3.24
Changes by Po-Chien Lin: - Update to 6.3.24 - Switch to OptionsNG - Remove unused variables: PATCH_STRIP, MAKE_ENV - Rearrange ordering of some sections - Use PORTDOCS to handle document list instead of pkg-plist - Alter pkg-plst to make portlint(1) happier - Cleanup TABs - Set USE_PYTHON_RUN only if X11 option is set. - Rename files/fetchmailconf to files/fetchmailconf.in,   add it into SUB_FILES

Changes by Corey Halpin (maintainer):
- Update MASTER_SITES

PR:		174873
Submitted by:	Po-Chien Lin <linpc@cs.nctu.edu.tw>
Approved by:	Corey Halpin (maintainer)
8dfad65ec8
Matthias Andree (mandree) · 6.3.22
Update to upstream release fetchmail 6.3.22.

Fixes CVE-2011-3389 (reenabling a countermeasure against
chosen-plaintext attacks against block cipher initialization)

Fixes CVE-2012-3482 (vulnerabilities in NTLM authentication; already
fixed in FreeBSD's port 6.3.21_1)

Assorted other fixes and workarounds.

Adds a Swedish translation.

Release Notes:	http://developer.berlios.de/project/shownotes.php?release_id=19117

PR:		171177
Approved by:	Corey Halpin (maintainer)
Security:	CVE-2012-3482
Security:	http://www.vuxml.org/freebsd/83f9e943-e664-11e1-a66d-080027ef73ec.html
Security:	CVE-2011-3389
Security:	http://www.vuxml.org/freebsd/18ce9a90-f269-11e1-be53-080027ef73ec.html
3a45d04f92
Adam Weinberger (adamw) · 6.3.21_1
Typo nit.
f54ca71c25
Matthias Andree (mandree) · 6.3.21_1
Update fetchmail to 6.3.21_1, fixing CVE-2012-3482. Adjust VuXML database entry from < 6.3.22 to < 6.3.21_1.

PR:		ports/170613
Approved by:	maintainer timeout (14 days)
Security:	http://www.vuxml.org/freebsd/83f9e943-e664-11e1-a66d-080027ef73ec.html
Security:	CVE-2012-3482
6b9d75c6d6
Cy Schubert (cy) · 6.3.21
Update 6.3.20 --> 6.3.21

PR:		165459
Approved by:	Maintainer (Corey Halpin <chalpin@cs.wisc.edu>)
9dd8c627df
Doug Barton (dougb) · 6.3.20_2
In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
83eb2c3700
Dmitry Marakasov (amdmi3) · 6.3.20_2
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:		157936
Submitted by:	myself
Exp-runs by:	pav
Approved by:	pav
6f6fbe4bdf
Matthias Andree (mandree) · 6.3.20_2
Fix critical fetchmail-embeds-NULs bug found by Antoine Levitt.
cb650d8b1d
Matthias Andree (mandree) · 6.3.20_1
Assorted minor fixes and touch-ups:

- Fix:     rcfile: export FETCHMAILUSER=$fetchmail_user [1]

- Fix:     when installing from source, make /var/run/fetchmail directory
           so that a global fetchmail installation won't break after port
           upgrades

- Change:  compile GSSAPI support by default (it's in base)

- Cleanup: rcfile: drop support for fetchmail.sh script name

- Cleanup: rcfile: don't mix backtick with apostrophe in comments, they don't
           match

Reported by:  thierry, Victor Balada Diaz <victor@bsdes.net> [1]
Suggested by: Victor Balada Diaz <victor@bsdes.net> [1]
PR:           ports/151783
Approved by:  maintainer timeout [1]
f12c178ff0
Chris Rees (crees) · 6.3.20
Use USERS and GROUPS

PR:		ports/157613
Submitted by:	crees (me)
Approved by:	rene (mentor, implicit), Corey Halpin (maintainer)
0d9a711a4e
Matthias Andree (mandree) · 6.3.20
Security update to new upstream release 6.3.20. Changes:     http://developer.berlios.de/project/shownotes.php?group_id=1824&release_id=18583 Security:    CVE-2011-1947              http://www.vuxml.org/freebsd/f7d838f2-9039-11e0-a051-080027ef73ec.html Approved by: Corey Halpin (maintainer) PR:          ports/157661
2ef6e5665b
Matthias Andree (mandree) · 6.3.19
Update to new upstream release 6.3.19.

Approved by:  Corey Halpin (maintainer)
Submitted by: mandree
PR:           ports/152999
d626429de1
Rene Ladan (rene) · 6.3.18
Fix build by skipping the validation of the XHTML 1.1 document Mailbox-Names-UTF7.html

PR:		ports/152067
Submitted by:	Matthias Andree [matthias.andree gmx.de]
Approved by:	maintainer
ddbb0b2377
Matthias Andree (mandree) · 6.3.18
Update to new upstream release 6.3.18.

Approved by: Corey Halpin (maintainer)
PR: ports/151686
37ee1acaa5
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.3.17_3
- Correct previous commit - Bump PORTREVISION

Reported by:	Alexander Milanov <a@amilanov.com>
Approved by:	pgollucci (mentor, implicit)
d1354ee8fe
Sunpoet Po-Chuan Hsieh (sunpoet) · 6.3.17_2
- Change PREFIX/etc/fetchmailrc.sample permission from 644 to 600 - Bump PORTREVISION

PR:		ports/151515
Submitted by:	Alexander Milanov <a@amilanov.com>
Approved by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer), pgollucci (mentor, implicit)
b24252f906
Ade Lovett (ade) · 6.3.17_1
Bounce PORTREVISION for gettext-related ports.  Have fun, ya'll.
8d837132c7
Sylvio Cesar Teixeira (sylvio) · 6.3.17
- Fix when run fetchmail with apop access.

PR:		ports/146002
Submitted by:	mkgt00@gmail.com
Approved by:	maintainer (timeout > 14days)
a72c1fdbf5
Martin Wilke (miwi) · 6.3.17
- Update to 6.3.17

PR:		146589
Submitted by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
6e49083cdb
Matthias Andree (mandree) · 6.3.16_1
Security fix for CVE-2010-1167.

This unbreaks the build, since this vulnerability is listed
at http://www.vuxml.org/freebsd/09910d76-4c82-11df-83fb-0015587e2cc1.html.

Add the recommended upstream patch.

Bump PORTREVISION.

PR: ports/145857
Approved by: Corey Halpin (maintainer)
Approved by: garga (mentor)
3e7180ed8c
Matthias Andree (mandree) · 6.3.16
Update to new upstream version.

Approved by: Corey Halpin (maintainer)
Approved by: garga@ (mentor)
459a4fe196
Martin Wilke (miwi) · 6.3.15
- Update to 6.3.14

PR:		145298
Submitted by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
8843e9971d
Doug Barton (dougb) · 6.3.14
Begin the process of deprecating sysutils/rc_subr by s#. %%RC_SUBR%%#. /etc/rc.subr#
1d6b4b3f91
Matthias Andree (mandree) · 6.3.14
Update to new upstream release 6.3.14. Changes:

# SECURITY FIXES
* SSL/TLS certificate information is now also reported properly on computers
  that consider the "char" type signed. Fixes malloc() buffer overrun.
  Workaround for older versions: do not use verbose mode.  CVE-2010-0562
  See fetchmail-SA-2010-01.txt for details, including a minimal patch.

# BUG FIXES
* The IMAP client no longer skips messages from several IMAP servers including
  Dovecot if fetchmail's "idle" is in use.  Causes were that fetchmail (a)
  ignored some untagged responses when it should not (b) relied on EXISTS
  messages in response to EXPUNGE, which aren't mandated by RFC-3501 (the IMAP
  standard) and aren't sent by Dovecot either.
    Fix by Sunil Shetye (the fix also consolidates IMAP response handling,
  improving overall robustness of the IMAP client), bug report and testing by
  Matt Doran, with further hints from Timo Sirainen.
* The SMTP client now recovers from errors (such as servers dropping the
  connection after errors) when sending an RSET command.
    Fix by Sunil Shetye. Report by James Moe.
* The IMAP client now uses "SEARCH UNSEEN" rather than "SEARCH UNSEEN NOT
  DELETED" again on IMAP2, to fix a regression in fetchmail 6.2.5 reported by
  Will Stringer in June 2004. (Sunil Shetye)
* The IMAP client now uses "SEARCH UNSEEN UNDELETED" on IMAP4 and IMAP4r1
  servers (Sunil Shetye).
* Workaround: The IMAP client now falls back to "FETCH n:m FLAGS" if the server
  does not support "SEARCH". (Sunil Shetye)
* The IMAP client now requests message numbers in batches of 1,000 to avoid
  problems if there are more than 1860 unseen messages. (Sunil Shetye)
    Note that this wasn't security relevant because fetchmail would only read up
  to the maximum buffer size and leave the remainder of the string unread, going
  out of synch afterwards.
* Stricter validation of IMAP responses containing byte or message counts.

# CHANGES
* Only include gssapi.h if we're not including gssapi/gssapi.h, to fix a FreeBSD
  compiler warning about gssapi.h being obsolete.

# DOCUMENTATION
* The README.SSL document was revised for grammar, spelling, and clarity.
  Courtesy of Robert Mullin.

# TRANSLATION UPDATES
* [it]    Italian, by Vincenzo Campanella
----------

Approved by:	Corey Halpin (port maintainer)
Approved by:	miwi@ (mentor)
dd5c15ff3f
Martin Wilke (miwi) · 6.3.13
- Update to 6.3.13 (updates translations and supports SMTP multiline replies) - Remove Kerberos IV support, insecure and obsolete - Mark BROKEN if KRB5_HOME is set and invalid - Kill pre-configure, no longer needed - Kill obsolete POP2 from make config menu, still available if given on make   command line - Auto-detect KRB5_HOME if it's $LOCALBASE or /usr - MARK_JOBS_SAFE=yes - Cease messing with 

PR:		140100
Submitted by:	Matthias Andree <matthias.andree@gmx.de>
Approved by:	maintainer
a3a756d06e
Wesley Shields (wxs) · 6.3.11_1
- Add a patch to fix segfault on startup.

PR:		ports/137972
Submitted by:	Christian Ludwig <chrissicool@chrissicool.net>
Approved by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
82c4b96e97
Dmitry Marakasov (amdmi3) · 6.3.11
- Update to 6.3.11

PR:		137604
Submitted by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
http://www.freebsd.org/ports/portaudit/5179d85c-8683-11de-91b9-0022157515b2.html
9b5d944bdc
Dmitry Marakasov (amdmi3) · 6.3.10
- Update to 6.3.10 - Portlint

PR:		136774
Submitted by:	Corey Halpin <chalpin@cs.wisc.edu> (maintainer)
d0ff441f6c