package with security hole not flagged at build time

["Steven M. Bellovin" <smb%cs.columbia.edu@localhost>]

According to audit-packages, fetchmail-6.2.5.5nb1 has a security hole.
When I go to its directory and do a 'make', it builds it without
noticing the problem.  My pkgsrc is up-to-date (HEAD), as is my
audit-packages and the vulnerabilities file it uses.  (This is on
-current from about two weeks ago.)

                --Steve Bellovin, http://www.cs.columbia.edu/~smb