Vulnerability · Published Sep 9, 2023 · Assigned by GitLab
CVE-2023-4875Undefined Behavior for Input to API in Mutt
Low 2.2
In plain English
A low-severity security flaw in Mutt from Mutt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.2Low
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | mutt | 5:2.0.7-3.el8 | ALSA-2024:3058 |
| AlmaLinux:9 | mutt | 5:2.2.6-2.el9 | ALSA-2024:2290 |
| Debian:12 | mutt | 2.2.9-1+deb12u1 | DEBIAN-CVE-2023-4875 |
| Debian:12 | mutt | 2.2.9-1+deb12u1 | DSA-5494-1 |
| Debian:13 | mutt | 2.2.12-0.1 | DEBIAN-CVE-2023-4875 |
| Debian:14 | mutt | 2.2.12-0.1 | DEBIAN-CVE-2023-4875 |
| Rocky Linux:8 | mutt | 5:2.0.7-3.el8 | RLSA-2024:3058 |
| Rocky Linux:9 | mutt | 5:2.2.6-2.el9 | RLSA-2024:2290 |
| Ubuntu:22.04:LTS | mutt | 2.1.4-1ubuntu1.2 | USN-6374-1 |
| Ubuntu:22.04:LTS | mutt | 2.1.4-1ubuntu1.2 | UBUNTU-CVE-2023-4875 |
Affected products (as reported)
Weakness: CWE-475 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch
- https://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6.patch
- https://www.debian.org/security/2023/dsa-5494 x_transferred
- https://lists.debian.org/debian-lts-announce/2023/09/msg00021.html x_transferred
- http://www.openwall.com/lists/oss-security/2023/09/26/6 x_transferred