mutt-2.0.7-2.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11069-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z mutt-2.0.7-2.2 on GA media These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11069 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2007-1558/ SUSE CVE CVE-2007-1558 page https://www.suse.com/security/cve/CVE-2018-14349/ SUSE CVE CVE-2018-14349 page https://www.suse.com/security/cve/CVE-2018-14350/ SUSE CVE CVE-2018-14350 page https://www.suse.com/security/cve/CVE-2018-14351/ SUSE CVE CVE-2018-14351 page https://www.suse.com/security/cve/CVE-2018-14352/ SUSE CVE CVE-2018-14352 page https://www.suse.com/security/cve/CVE-2018-14353/ SUSE CVE CVE-2018-14353 page https://www.suse.com/security/cve/CVE-2018-14354/ SUSE CVE CVE-2018-14354 page https://www.suse.com/security/cve/CVE-2018-14355/ SUSE CVE CVE-2018-14355 page https://www.suse.com/security/cve/CVE-2018-14356/ SUSE CVE CVE-2018-14356 page https://www.suse.com/security/cve/CVE-2018-14357/ SUSE CVE CVE-2018-14357 page https://www.suse.com/security/cve/CVE-2018-14358/ SUSE CVE CVE-2018-14358 page https://www.suse.com/security/cve/CVE-2018-14359/ SUSE CVE CVE-2018-14359 page https://www.suse.com/security/cve/CVE-2018-14360/ SUSE CVE CVE-2018-14360 page https://www.suse.com/security/cve/CVE-2018-14361/ SUSE CVE CVE-2018-14361 page https://www.suse.com/security/cve/CVE-2018-14362/ SUSE CVE CVE-2018-14362 page https://www.suse.com/security/cve/CVE-2018-14363/ SUSE CVE CVE-2018-14363 page https://www.suse.com/security/cve/CVE-2020-14093/ SUSE CVE CVE-2020-14093 page https://www.suse.com/security/cve/CVE-2020-14954/ SUSE CVE CVE-2020-14954 page https://www.suse.com/security/cve/CVE-2020-28896/ SUSE CVE CVE-2020-28896 page https://www.suse.com/security/cve/CVE-2021-3181/ SUSE CVE CVE-2021-3181 page https://www.suse.com/security/cve/CVE-2021-32055/ SUSE CVE CVE-2021-32055 page openSUSE Tumbleweed mutt-2.0.7-2.2 mutt-doc-2.0.7-2.2 mutt-lang-2.0.7-2.2 mutt-2.0.7-2.2 as a component of openSUSE Tumbleweed mutt-doc-2.0.7-2.2 as a component of openSUSE Tumbleweed mutt-lang-2.0.7-2.2 as a component of openSUSE Tumbleweed The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products. CVE-2007-1558 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 low 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-1558.html CVE-2007-1558 https://bugzilla.suse.com/262450 SUSE Bug 262450 https://bugzilla.suse.com/271197 SUSE Bug 271197 https://bugzilla.suse.com/279843 SUSE Bug 279843 https://bugzilla.suse.com/281321 SUSE Bug 281321 https://bugzilla.suse.com/281323 SUSE Bug 281323 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. CVE-2018-14349 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14349.html CVE-2018-14349 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101589 SUSE Bug 1101589 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field. CVE-2018-14350 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14350.html CVE-2018-14350 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101588 SUSE Bug 1101588 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. CVE-2018-14351 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14351.html CVE-2018-14351 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101583 SUSE Bug 1101583 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow. CVE-2018-14352 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14352.html CVE-2018-14352 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101582 SUSE Bug 1101582 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow. CVE-2018-14353 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14353.html CVE-2018-14353 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101581 SUSE Bug 1101581 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription. CVE-2018-14354 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14354.html CVE-2018-14354 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101578 SUSE Bug 1101578 https://bugzilla.suse.com/1101581 SUSE Bug 1101581 https://bugzilla.suse.com/1101589 SUSE Bug 1101589 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name. CVE-2018-14355 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14355.html CVE-2018-14355 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101577 SUSE Bug 1101577 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID. CVE-2018-14356 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14356.html CVE-2018-14356 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101576 SUSE Bug 1101576 https://bugzilla.suse.com/1101589 SUSE Bug 1101589 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription. CVE-2018-14357 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14357.html CVE-2018-14357 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101573 SUSE Bug 1101573 https://bugzilla.suse.com/1101581 SUSE Bug 1101581 https://bugzilla.suse.com/1101589 SUSE Bug 1101589 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field. CVE-2018-14358 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14358.html CVE-2018-14358 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101571 SUSE Bug 1101571 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data. CVE-2018-14359 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14359.html CVE-2018-14359 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101570 SUSE Bug 1101570 https://bugzilla.suse.com/1101589 SUSE Bug 1101589 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage. CVE-2018-14360 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14360.html CVE-2018-14360 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101569 SUSE Bug 1101569 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data. CVE-2018-14361 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14361.html CVE-2018-14361 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101568 SUSE Bug 1101568 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character. CVE-2018-14362 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14362.html CVE-2018-14362 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101567 SUSE Bug 1101567 https://bugzilla.suse.com/1101589 SUSE Bug 1101589 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames. CVE-2018-14363 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 important 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14363.html CVE-2018-14363 https://bugzilla.suse.com/1101428 SUSE Bug 1101428 https://bugzilla.suse.com/1101566 SUSE Bug 1101566 https://bugzilla.suse.com/1101593 SUSE Bug 1101593 Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. CVE-2020-14093 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-14093.html CVE-2020-14093 https://bugzilla.suse.com/1172906 SUSE Bug 1172906 https://bugzilla.suse.com/1172935 SUSE Bug 1172935 Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection." CVE-2020-14954 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-14954.html CVE-2020-14954 https://bugzilla.suse.com/1173197 SUSE Bug 1173197 Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle. CVE-2020-28896 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-28896.html CVE-2020-28896 https://bugzilla.suse.com/1179035 SUSE Bug 1179035 rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons. CVE-2021-3181 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3181.html CVE-2021-3181 https://bugzilla.suse.com/1181221 SUSE Bug 1181221 https://bugzilla.suse.com/1181505 SUSE Bug 1181505 Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default. CVE-2021-32055 openSUSE Tumbleweed:mutt-2.0.7-2.2 openSUSE Tumbleweed:mutt-doc-2.0.7-2.2 openSUSE Tumbleweed:mutt-lang-2.0.7-2.2 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-32055.html CVE-2021-32055 https://bugzilla.suse.com/1185705 SUSE Bug 1185705