Fetchmail - remote code injection vulnerability

There is a possibility to inject code into fetchmail by using a manipulated POP3 server.
The fetchmail stack can be overflowed with very long UIDs.

All versions in Debian apart from oldstable are affected. The ftpmaster server is down until Monday so we will upload a new fixed version on Monday.
For those who not use the debian package please update to version 6.2.5.2 from:
http://download.berlios.de/fetchmail/
and use this patch.
There is no workaround at the moment.

The bug has been assigned to CVE CAN-2005-2335, which is not yet online.
Until the page is online you can have a look at the original advisory on:
http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt.

I wrote a mail to the security team so hopefully they will have the time to make a quick update for the version in stable.