Re: The 6.6.7.rc1 release candidate is available (security fix for NTLM protocol, possible RCE)

On Mon, 13 Jul 2026, Norman Ramsey wrote:

> > The 6.6.7.rc1 release candidate of fetchmail tightens code
> > around a security vulnerability in the NTLM code.
> > It is now available at the usual locations, including
> > <https://downloads.sourceforge.net/project/fetchmail/branch_6.6/>.
>
> Building on Debian stable, I'm running into this build issue, which is
> not addressed in the FAQ:
>
>    nr@homedog ~/n/fetchmail> make check
>    CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh /home/nr/net/fetchmail/missing aclocal-1.14 -I m4 -I m4-local
>    /home/nr/net/fetchmail/missing: 81: aclocal-1.14: not found
>    WARNING: 'aclocal-1.14' is missing on your system.
>             You should only need it if you modified 'acinclude.m4' or
>             'configure.ac' or m4 files included by 'configure.ac'.
>             The 'aclocal' program is part of the GNU Automake package:
>             <http://www.gnu.org/software/automake>
>             It also requires GNU Autoconf, GNU m4 and Perl in order to run:
>             <http://www.gnu.org/software/autoconf>
>             <http://www.gnu.org/software/m4/>
>             <http://www.perl.org/>
>    make: *** [Makefile:893: aclocal.m4] Error 127
>    nr@homedog ~/n/fetchmail [2]> l /usr/bin/aclocal*
>    /usr/bin/aclocal@  /usr/bin/aclocal-1.15*  /usr/bin/aclocal-1.17*
>
> I did not modify the files that are mentioned.
>
> Running `make install` is also blocked by this error.
>
> I can globally replace aclocal-1.14 with aclocal 1.15, but if the
> Makefile is looking for such a specific version, perhaps I should not
> tinker with things I don't understand.
>
> Please advise me how to proceed.

I think
         rm Makefile ; configure
should be sufficient. Add whatever configure options you usually use.

If not, you may need to run
         rm Makefile.in ; automake
and then then above
         rm Makefile ; configure
again.

It looks like your automake has been updated since you last built 
fetchmail,
so removing config.status and/or or autom4te.cache/
*might* be appropriate too.

-- 
Andrew C. Aitchison                      Kendal, UK
                    [email protected]