CVE-2023-4875
published 2023-09-09CVE-2023-4875: Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
PriorityP425medium5.7CVSS 3.1
AVNACLPRLUIRSUCNINAH
EPSS
0.51%
39.8th percentile
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | mutt | < mutt 2.2.9-1+deb12u1 (bookworm) | mutt 2.2.9-1+deb12u1 (bookworm) |
| gitlab | mutt | — | — |
| msrc | cbl2_mutt_2.2.12-1_on_cbl_mariner_2.0 | — | — |
| mutt | mutt | < 2.2.12 | 2.2.12 |
| mutt | mutt | >= 0 < 2.0.5-4.1+deb11u3 | 2.0.5-4.1+deb11u3 |
| mutt | mutt | >= 0 < 2.2.9-1+deb12u1 | 2.2.9-1+deb12u1 |
| mutt | mutt | >= 0 < 2.2.12-0.1 | 2.2.12-0.1 |
| mutt | mutt | >= 0 < 2.2.12-0.1 | 2.2.12-0.1 |
| mutt | mutt | >= 0 < 1.13.2-1ubuntu0.6 | 1.13.2-1ubuntu0.6 |
| mutt | mutt | >= 0 < 2.1.4-1ubuntu1.2 | 2.1.4-1ubuntu1.2 |
| mutt | mutt | >= 0 < 2.2.9-1ubuntu0.23.10.1 | 2.2.9-1ubuntu0.23.10.1 |
| mutt | mutt | >= 0 < 1.5.24-1ubuntu0.6+esm3 | 1.5.24-1ubuntu0.6+esm3 |
| mutt | mutt | >= 0 < 1.9.4-3ubuntu0.6+esm1 | 1.9.4-3ubuntu0.6+esm1 |
| mutt | mutt | >= 1.5.2 < 2.2.12 | 2.2.12 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_msrc5.7MEDIUM
vendor_ubuntu4.3MEDIUM
vendor_debian2.2LOW
vendor_redhat2.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Mutt vulnerabilities
vendor_ubuntu·2023-10-19·CVSS 4.3
CVE-2023-4875 [MEDIUM] Mutt vulnerabilities
Title: Mutt vulnerabilities
Summary: Mutt could be made to crash if it received specially crafted
input.
USN-6374-1 fixed vulnerabilities in Mutt. This update provides the
corresponding updates for Ubuntu 23.10.
Original advisory details:
It was discovered that Mutt incorrectly handled certain email header
contents. If a user were tricked into opening a specially crafted message,
a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2023-4874, CVE-2023-4875)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Mutt vulnerabilities
vendor_ubuntu·2023-09-14·CVSS 4.3
CVE-2023-4874 [MEDIUM] Mutt vulnerabilities
Title: Mutt vulnerabilities
Summary: Mutt could be made to crash if it received specially crafted
input.
It was discovered that Mutt incorrectly handled certain email header
contents. If a user were tricked into opening a specially crafted message,
a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2023-4874, CVE-2023-4875)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Undefined Behavior for Input to API in Mutt
vendor_msrc·2023-09-12·CVSS 5.7
CVE-2023-4875 [LOW] CWE-476 Undefined Behavior for Input to API in Mutt
Undefined Behavior for Input to API in Mutt
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitLab: GitLab
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft
GitLab
Undefined Behavior for Input to API in Mutt
vendor_gitlab·2023-09-09·CVSS 5.7
CVE-2023-4875 [MEDIUM] CWE-475 Undefined Behavior for Input to API in Mutt
Undefined Behavior for Input to API in Mutt
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 =1.5.2, <2.2.12 (affected)
Solution: Upgrade to version 2.2.12
Credit: Chenyuan Mi
Red Hat
mutt: null pointer dereference
vendor_redhat·2023-09-09·CVSS 2.2
CVE-2023-4875 [LOW] CWE-476 mutt: null pointer dereference
mutt: null pointer dereference
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
A null pointer dereference flaw was found in mutt when handling specially crafted characters. This issue could allow an attacker to send a specially crafted email that causes the email client to crash when reading or processing the email.
Statement: This is a local client crash caused by a specially crafted email. No code execution is expected. This flaw has been rated as having moderate security impact.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Debian
CVE-2023-4875: mutt - Null pointer dereference when composing from a specially crafted draft message i...
vendor_debian·2023·CVSS 2.2
CVE-2023-4875 [LOW] CVE-2023-4875: mutt - Null pointer dereference when composing from a specially crafted draft message i...
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
Scope: local
bookworm: resolved (fixed in 2.2.9-1+deb12u1)
bullseye: resolved (fixed in 2.0.5-4.1+deb11u3)
forky: resolved (fixed in 2.2.12-0.1)
sid: resolved (fixed in 2.2.12-0.1)
trixie: resolved (fixed in 2.2.12-0.1)
OSV
mutt vulnerabilities
osv·2023-10-19·CVSS 6.5
CVE-2023-4874 [MEDIUM] mutt vulnerabilities
mutt vulnerabilities
USN-6374-1 fixed vulnerabilities in Mutt. This update provides the
corresponding updates for Ubuntu 23.10.
Original advisory details:
It was discovered that Mutt incorrectly handled certain email header
contents. If a user were tricked into opening a specially crafted message,
a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2023-4874, CVE-2023-4875)
OSV
mutt vulnerabilities
osv·2023-09-14·CVSS 6.5
CVE-2023-4874 [MEDIUM] mutt vulnerabilities
mutt vulnerabilities
It was discovered that Mutt incorrectly handled certain email header
contents. If a user were tricked into opening a specially crafted message,
a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2023-4874, CVE-2023-4875)
GHSA
GHSA-fwwc-f8hw-qfwf: Null pointer dereference when composing from a specially crafted draft message in Mutt >1
ghsa_unreviewed·2023-09-09
CVE-2023-4875 [MEDIUM] CWE-475 GHSA-fwwc-f8hw-qfwf: Null pointer dereference when composing from a specially crafted draft message in Mutt >1
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
OSV
CVE-2023-4875: Null pointer dereference when composing from a specially crafted draft message in Mutt >1
osv·2023-09-09·CVSS 5.7
CVE-2023-4875 [MEDIUM] CVE-2023-4875: Null pointer dereference when composing from a specially crafted draft message in Mutt >1
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
No detection rules found.
No public exploits indexed.
https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patchhttps://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6.patchhttp://www.openwall.com/lists/oss-security/2023/09/26/6https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patchhttps://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6.patchhttps://lists.debian.org/debian-lts-announce/2023/09/msg00021.htmlhttps://www.debian.org/security/2023/dsa-5494
2023-09-09
Published