Debian Mutt vulnerabilities

CVE-2020-28896 [MEDIUM] CVE-2020-28896: mutt - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_t... Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-midd

CVE-2018-14355 [MEDIUM] CVE-2018-14355: mutt - An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. ima... An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name. Scope: local bookworm: resolved (fixed in 1.10.1-1) bullseye: resolved (fixed in 1.10.1-1) forky: resolved (fixed in 1.10.1-1) sid: resolved (fixed in 1.10.1-1) trixie: resolved (fixed in 1.10.1-1)

CVE-2021-3181 [MEDIUM] CVE-2021-3181: mutt - rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of serv... rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from

CVE-2003-0140 [HIGH] CVE-2003-0140: mutt - Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, ... Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder. Scope: local bookworm: resolved (fixed in 1.5.4-1) bullseye: resolved (fixed in 1.5.4-1) fork

CVE-2020-14093 [MEDIUM] CVE-2020-14093: mutt - Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PR... Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. Scope: local bookworm: resolved (fixed in 1.14.3-1) bullseye: resolved (fixed in 1.14.3-1) forky: resolved (fixed in 1.14.3-1) sid: resolved (fixed in 1.14.3-1) trixie: resolved (fixed in 1.14.3-1)

CVE-2024-49393 [MEDIUM] CVE-2024-49393: mutt - In neomutt and mutt, the To and Cc email headers are not validated by cryptograp... In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2023-4874 [MEDIUM] CVE-2023-4874: mutt - Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <... Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 Scope: local bookworm: resolved (fixed in 2.2.9-1+deb12u1) bullseye: resolved (fixed in 2.0.5-4.1+deb11u3) forky: resolved (fixed in 2.2.12-0.1) sid: resolved (fixed in 2.2.12-0.1) trixie: resolved (fixed in 2.2.12-0.1)

CVE-2009-1390 [MEDIUM] CVE-2009-1390: mutt - Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ss... Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack. Scope: local bookworm: resolved (fixed in 1.5.20-1) bullseye: resolved (fixed

CVE-2022-1328 [MEDIUM] CVE-2022-1328: mutt - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.1... Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line Scope: local bookworm: resolved (fixed in 2.2.3-1) bullseye: resolved (fixed in 2.0.5-4.1+deb11u1) forky: resolved (fixed in 2.2.3-1) sid: resolved (fixed in 2.2.3-1) trixie: resolved (fixed in 2.2.3-1)

CVE-2003-0167 [HIGH] CVE-2003-0167: balsa - Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and ... Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140. Scope: local bookworm: resolved (fixed in 2.0.10) bullseye: r

CVE-2011-1429 [MEDIUM] CVE-2011-1429: mutt - Mutt does not verify that the smtps server hostname matches the domain name of t... Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766. Scope: local bookworm: resolved (fixed in 1.5.21-5) bullseye: resolved (fixed in 1.5.21-5) forky: resolved (fi

CVE-2014-0467 [MEDIUM] CVE-2014-0467: mutt - Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause... Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion. Scope: local bookworm: resolved (fixed in 1.5.22-2) bullseye: resolved (fixed in 1.5.22-2) forky: resolved (fixed in 1.5.22-2) sid: resolved (fixed in 1.5.22-2) trixie: resolved (fixed in 1.5.22-2)

CVE-2024-49394 [MEDIUM] CVE-2024-49394: mutt - In mutt and neomutt the In-Reply-To email header field is not protected by crypt... In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2023-4875 [LOW] CVE-2023-4875: mutt - Null pointer dereference when composing from a specially crafted draft message i... Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 Scope: local bookworm: resolved (fixed in 2.2.9-1+deb12u1) bullseye: resolved (fixed in 2.0.5-4.1+deb11u3) forky: resolved (fixed in 2.2.12-0.1) sid: resolved (fixed in 2.2.12-0.1) trixie: resolved (fixed in 2.2.12-0.1)

CVE-2020-14154 [MEDIUM] CVE-2020-14154: mutt - Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS c... Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate. Scope: local bookworm: resolved (fixed in 1.14.3-1) bullseye: resolved (fixed in 1.14.3-1) forky: resolved (fixed in 1.14.3-1) sid: resolved (fixed in 1.14.3-1) trixie: resolved (fixed in 1.14.3-1)

CVE-2005-2351 [MEDIUM] CVE-2005-2351: mutt - Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a... Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files. Scope: local bookworm: resolved (fixed in 1.5.20-7) bullseye: resolved (fixed in 1.5.20-7) forky: resolved (fixed in 1.5.20-7) sid: resolved (fixed in 1.5.20-7) trixie: resolved (fixed in 1.5.20-7)

CVE-2007-1558 [LOW] CVE-2007-1558: balsa - The APOP protocol allows remote attackers to guess the first 3 characters of a p... The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8

CVE-2006-5297 [LOW] CVE-2006-5297: mutt - Race condition in the safe_open function in the Mutt mail client 1.5.12 and earl... Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems. Scope: local bookworm: resolved (fixed in 1.5.13-1.1) bullseye: resolved (fixed in 1.5.13-1.1) forky: resolved (fixed in

CVE-2006-5298 [LOW] CVE-2006-5298: mutt - The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not... The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls. Scope: local bookworm: resolved (fixed in 1.5.13-1.1) bullseye: resolv