Re: The 6.6.7.rc1 release candidate is available (security fix for NTLM protocol, possible RCE)

Norman Ramsey <[email protected]> Mon, 13 Jul 2026 10:38:20 -0400
Newsgroups gmane.mail.fetchmail.user
Message-ID <[email protected]>
 > The 6.6.7.rc1 release candidate of fetchmail tightens code
 > around a security vulnerability in the NTLM code.
 > It is now available at the usual locations, including 
 > <https://downloads.sourceforge.net/project/fetchmail/branch_6.6/>.

Building on Debian stable, I'm running into this build issue, which is
not addressed in the FAQ:

    nr@homedog ~/n/fetchmail> make check
    CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh /home/nr/net/fetchmail/missing aclocal-1.14 -I m4 -I m4-local
    /home/nr/net/fetchmail/missing: 81: aclocal-1.14: not found
    WARNING: 'aclocal-1.14' is missing on your system.
             You should only need it if you modified 'acinclude.m4' or
             'configure.ac' or m4 files included by 'configure.ac'.
             The 'aclocal' program is part of the GNU Automake package:
             <http://www.gnu.org/software/automake>
             It also requires GNU Autoconf, GNU m4 and Perl in order to run:
             <http://www.gnu.org/software/autoconf>
             <http://www.gnu.org/software/m4/>
             <http://www.perl.org/>
    make: *** [Makefile:893: aclocal.m4] Error 127
    nr@homedog ~/n/fetchmail [2]> l /usr/bin/aclocal*
    /usr/bin/aclocal@  /usr/bin/aclocal-1.15*  /usr/bin/aclocal-1.17*

I did not modify the files that are mentioned.

Running `make install` is also blocked by this error.

I can globally replace aclocal-1.14 with aclocal 1.15, but if the
Makefile is looking for such a specific version, perhaps I should not
tinker with things I don't understand.

Please advise me how to proceed.


Norman Ramsey