See this question for a discussion on the same theme. In a nutshell: collision attacks do not directly harm HMAC. But the existence of collision attacks implies that the compression function on which the hash function is built is not a "random oracle", and this voids the HMAC security proof.