The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mutt: buffer overflow via base64 data (CVE-2018-14359)

  - The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning     of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty     body, which triggers a heap-based buffer overflow in the mutt_substrdup function. (CVE-2014-9116)

  - An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a     NO response without a message. (CVE-2018-14349)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mutt: buffer overflow via base64 data (CVE-2018-14359)

  - The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning     of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty     body, which triggers a heap-based buffer overflow in the mutt_substrdup function. (CVE-2014-9116)

  - An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a     NO response without a message. (CVE-2018-14349)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for mutt fixes the following issues :

Security issues fixed :

bsc#1101428: Mutt 1.10.1 security release update.

CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).

CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).

CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).

CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).

CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).

CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).

CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).

CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).

CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).

CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).

CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).

CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).

CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).

CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).

CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes: mutt reports as neomutt and incorrect version (bsc#1094717)

No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)

mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)

(neo)mutt displaying times in Zulu time (bsc#1061343)

mutt unconditionally segfaults when displaying a message (bsc#986534)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mutt fixes the following issues :

Security issues fixed :

  - bsc#1101428: Mutt 1.10.1 security release update.

  - CVE-2018-14351: Fix imap/command.c that mishandles long     IMAP status mailbox literal count size (bsc#1101583).

  - CVE-2018-14353: Fix imap_quote_string in imap/util.c     that has an integer underflow (bsc#1101581).

  - CVE-2018-14362: Fix pop.c that does not forbid     characters that may have unsafe interaction with     message-cache pathnames (bsc#1101567).

  - CVE-2018-14354: Fix arbitrary command execution from     remote IMAP servers via backquote characters     (bsc#1101578).

  - CVE-2018-14352: Fix imap_quote_string in imap/util.c     that does not leave room for quote characters     (bsc#1101582).

  - CVE-2018-14356: Fix pop.c that mishandles a zero-length     UID (bsc#1101576).

  - CVE-2018-14355: Fix imap/util.c that mishandles '..'     directory traversal in a mailbox name (bsc#1101577).

  - CVE-2018-14349: Fix imap/command.c that mishandles a NO     response without a message (bsc#1101589).

  - CVE-2018-14350: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along INTERNALDATE field (bsc#1101588).

  - CVE-2018-14363: Fix newsrc.c that does not     properlyrestrict '/' characters that may have unsafe     interaction with cache pathnames (bsc#1101566).

  - CVE-2018-14359: Fix buffer overflow via base64 data     (bsc#1101570).

  - CVE-2018-14358: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along RFC822.SIZE field (bsc#1101571).

  - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has     a stack-based buffer overflow because of incorrect     sscanf usage (bsc#1101569).

  - CVE-2018-14357: Fix that remote IMAP servers are allowed     to execute arbitrary commands via backquote characters     (bsc#1101573).

  - CVE-2018-14361: Fix that nntp.c proceeds even if memory     allocation fails for messages data (bsc#1101568).

Bug fixes :

  - mutt reports as neomutt and incorrect version     (bsc#1094717)

This update was imported from the SUSE:SLE-15:Update update project.

This update for mutt fixes the following issues :

Security issues fixed :

  - bsc#1101428: Mutt 1.10.1 security release update.

  - CVE-2018-14351: Fix imap/command.c that mishandles long     IMAP status mailbox literal count size (bsc#1101583).

  - CVE-2018-14353: Fix imap_quote_string in imap/util.c     that has an integer underflow (bsc#1101581).

  - CVE-2018-14362: Fix pop.c that does not forbid     characters that may have unsafe interaction with     message-cache pathnames (bsc#1101567).

  - CVE-2018-14354: Fix arbitrary command execution from     remote IMAP servers via backquote characters     (bsc#1101578).

  - CVE-2018-14352: Fix imap_quote_string in imap/util.c     that does not leave room for quote characters     (bsc#1101582).

  - CVE-2018-14356: Fix pop.c that mishandles a zero-length     UID (bsc#1101576).

  - CVE-2018-14355: Fix imap/util.c that mishandles '..'     directory traversal in a mailbox name (bsc#1101577).

  - CVE-2018-14349: Fix imap/command.c that mishandles a NO     response without a message (bsc#1101589).

  - CVE-2018-14350: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along INTERNALDATE field (bsc#1101588).

  - CVE-2018-14363: Fix newsrc.c that does not     properlyrestrict '/' characters that may have unsafe     interaction with cache pathnames (bsc#1101566).

  - CVE-2018-14359: Fix buffer overflow via base64 data     (bsc#1101570).

  - CVE-2018-14358: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along RFC822.SIZE field (bsc#1101571).

  - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has     a stack-based buffer overflow because of incorrect     sscanf usage (bsc#1101569).

  - CVE-2018-14357: Fix that remote IMAP servers are allowed     to execute arbitrary commands via backquote characters     (bsc#1101573).

  - CVE-2018-14361: Fix that nntp.c proceeds even if memory     allocation fails for messages data (bsc#1101568).

Bug fixes :

  - mutt reports as neomutt and incorrect version     (bsc#1094717)

  - No sidebar available in mutt 1.6.1 from Tumbleweed     snapshot 20160517 (bsc#980830)

  - mutt-1.6.1 unusable when built with --enable-sidebar     (bsc#982129)

  - (neo)mutt displaying times in Zulu time (bsc#1061343)

  - mutt unconditionally segfaults when displaying a message     (bsc#986534)

  - For openSUSE Leap 42.3, retain split of -lang and -doc     (boo#1120935)

This update was imported from the SUSE:SLE-12:Update update project.

This update for mutt fixes the following issues: Security issues fixed :

  - bsc#1101428: Mutt 1.10.1 security release update.

  - CVE-2018-14351: Fix imap/command.c that mishandles long     IMAP status mailbox literal count size (bsc#1101583).

  - CVE-2018-14353: Fix imap_quote_string in imap/util.c     that has an integer underflow (bsc#1101581).

  - CVE-2018-14362: Fix pop.c that does not forbid     characters that may have unsafe interaction with     message-cache pathnames (bsc#1101567).

  - CVE-2018-14354: Fix arbitrary command execution from     remote IMAP servers via backquote characters     (bsc#1101578).

  - CVE-2018-14352: Fix imap_quote_string in imap/util.c     that does not leave room for quote characters     (bsc#1101582).

  - CVE-2018-14356: Fix pop.c that mishandles a zero-length     UID (bsc#1101576).

  - CVE-2018-14355: Fix imap/util.c that mishandles '..'     directory traversal in a mailbox name (bsc#1101577).

  - CVE-2018-14349: Fix imap/command.c that mishandles a NO     response without a message (bsc#1101589).

  - CVE-2018-14350: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along INTERNALDATE field (bsc#1101588).

  - CVE-2018-14363: Fix newsrc.c that does not     properlyrestrict '/' characters that may have unsafe     interaction with cache pathnames (bsc#1101566).

  - CVE-2018-14359: Fix buffer overflow via base64 data     (bsc#1101570).

  - CVE-2018-14358: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along RFC822.SIZE field (bsc#1101571).

  - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has     a stack-based buffer overflow because of incorrect     sscanf usage (bsc#1101569).

  - CVE-2018-14357: Fix that remote IMAP servers are allowed     to execute arbitrary commands via backquote characters     (bsc#1101573).

  - CVE-2018-14361: Fix that nntp.c proceeds even if memory     allocation fails for messages data (bsc#1101568). Bug     fixes :

  - mutt reports as neomutt and incorrect version     (bsc#1094717)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mutt fixes the following issues: Security issues fixed :

  - bsc#1101428: Mutt 1.10.1 security release update.

  - CVE-2018-14351: Fix imap/command.c that mishandles long     IMAP status mailbox literal count size (bsc#1101583).

  - CVE-2018-14353: Fix imap_quote_string in imap/util.c     that has an integer underflow (bsc#1101581).

  - CVE-2018-14362: Fix pop.c that does not forbid     characters that may have unsafe interaction with     message-cache pathnames (bsc#1101567).

  - CVE-2018-14354: Fix arbitrary command execution from     remote IMAP servers via backquote characters     (bsc#1101578).

  - CVE-2018-14352: Fix imap_quote_string in imap/util.c     that does not leave room for quote characters     (bsc#1101582).

  - CVE-2018-14356: Fix pop.c that mishandles a zero-length     UID (bsc#1101576).

  - CVE-2018-14355: Fix imap/util.c that mishandles '..'     directory traversal in a mailbox name (bsc#1101577).

  - CVE-2018-14349: Fix imap/command.c that mishandles a NO     response without a message (bsc#1101589).

  - CVE-2018-14350: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along INTERNALDATE field (bsc#1101588).

  - CVE-2018-14363: Fix newsrc.c that does not     properlyrestrict '/' characters that may have unsafe     interaction with cache pathnames (bsc#1101566).

  - CVE-2018-14359: Fix buffer overflow via base64 data     (bsc#1101570).

  - CVE-2018-14358: Fix imap/message.c that has a     stack-based buffer overflow for a FETCH response with     along RFC822.SIZE field (bsc#1101571).

  - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has     a stack-based buffer overflow because of incorrect     sscanf usage (bsc#1101569).

  - CVE-2018-14357: Fix that remote IMAP servers are allowed     to execute arbitrary commands via backquote characters     (bsc#1101573).

  - CVE-2018-14361: Fix that nntp.c proceeds even if memory     allocation fails for messages data (bsc#1101568). Bug     fixes :

  - mutt reports as neomutt and incorrect version     (bsc#1094717)

  - No sidebar available in mutt 1.6.1 from Tumbleweed     snapshot 20160517 (bsc#980830)

  - mutt-1.6.1 unusable when built with --enable-sidebar     (bsc#982129)

  - (neo)mutt displaying times in Zulu time (bsc#1061343)

  - mutt unconditionally segfaults when displaying a message     (bsc#986534)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-04 (Mutt: Heap-based buffer overflow)

    A heap-based buffer overflow was discovered in Mutt&rsquo;s mutt_substrdup       function.
  Impact :

    A remote attacker could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

mutt was updated to fix one security issue.

This security issue was fixed :

  - Heap-based buffer overflow in mutt_substrdup()     (CVE-2014-9116).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The mutt mail client has been updated to fix a heap-based buffer overflow in mutt_substrdup(). (CVE-2014-9116)

Additionally, a patch has been added to allow users to override the 'From' address when executing mutt in batch mode.

New mutt packages are available for Slackware 13.37, 14.0, 14.1, and
-current to fix a security issue.

Updated mutt packages fix security vulnerability :

A flaw was discovered in mutt. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition (CVE-2014-9116).

The mutt package has been updated to version 1.5.23 and patched to fix this issue.

Security fix for

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD reports :

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

mutt was updated to fix a security issue with a heap-based buffer overflow in mutt_substrdup() (CVE-2014-9116).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2440-1 advisory.

    Jakub Wilk discovered that the write_one_header function in mutt did not properly handle newline     characters at the beginning of a header. An attacker could specially craft an email to cause mutt to     crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was discovered in mutt, a text-based mailreader. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition.

ID	Name	Product	Family	Severity
198396	RHEL 6 : mutt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198326	RHEL 7 : mutt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
124757	SUSE SLED12 / SLES12 Security Update : mutt (SUSE-SU-2019:1196-1)	Nessus	SuSE Local Security Checks	critical
123246	openSUSE Security Update : mutt (openSUSE-2019-569)	Nessus	SuSE Local Security Checks	critical
121281	openSUSE Security Update : mutt (openSUSE-2019-52)	Nessus	SuSE Local Security Checks	critical
120066	SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2018:2085-1)	Nessus	SuSE Local Security Checks	critical
111571	openSUSE Security Update : mutt (openSUSE-2018-809)	Nessus	SuSE Local Security Checks	critical
111435	SUSE SLED12 / SLES12 Security Update : mutt (SUSE-SU-2018:2084-1)	Nessus	SuSE Local Security Checks	critical
96235	GLSA-201701-04 : Mutt: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	medium
83660	SUSE SLED12 / SLES12 Security Update : mutt (SUSE-SU-2015:0012-1)	Nessus	SuSE Local Security Checks	medium
83049	SuSE 11.3 Security Update : mutt (SAT Patch Number 10435)	Nessus	SuSE Local Security Checks	medium
82920	Slackware 13.37 / 14.0 / 14.1 / current : mutt (SSA:2015-111-07)	Nessus	Slackware Local Security Checks	medium
82331	Mandriva Linux Security Advisory : mutt (MDVSA-2015:078)	Nessus	Mandriva Local Security Checks	medium
81347	Fedora 21 : mutt-1.5.23-7.fc21 (2014-16782)	Nessus	Fedora Local Security Checks	medium
81346	Fedora 20 : mutt-1.5.23-4.fc20 (2014-16494)	Nessus	Fedora Local Security Checks	medium
80238	FreeBSD : mutt -- denial of service via crafted mail message (c3d43001-8064-11e4-801f-0022156e8794)	Nessus	FreeBSD Local Security Checks	medium
80051	openSUSE Security Update : mutt (openSUSE-SU-2014:1635-1)	Nessus	SuSE Local Security Checks	medium
80027	Ubuntu 14.04 LTS : Mutt vulnerability (USN-2440-1)	Nessus	Ubuntu Local Security Checks	high
79990	Mandriva Linux Security Advisory : mutt (MDVSA-2014:245)	Nessus	Mandriva Local Security Checks	medium
79637	Debian DSA-3083-1 : mutt - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-9116

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium