Vulnerability · Published Sep 9, 2023 · Assigned by GitLab
CVE-2023-4874Undefined Behavior for Input to API in Mutt
Medium 4.3
In plain English
A medium-severity security flaw in Mutt from Mutt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.8%top 41.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | mutt | 5:2.0.7-3.el8 | ALSA-2024:3058 |
| AlmaLinux:9 | mutt | 5:2.2.6-2.el9 | ALSA-2024:2290 |
| Debian:12 | mutt | 2.2.9-1+deb12u1 | DEBIAN-CVE-2023-4874 |
| Debian:12 | mutt | 2.2.9-1+deb12u1 | DSA-5494-1 |
| Debian:13 | mutt | 2.2.12-0.1 | DEBIAN-CVE-2023-4874 |
| Debian:14 | mutt | 2.2.12-0.1 | DEBIAN-CVE-2023-4874 |
| Rocky Linux:8 | mutt | 5:2.0.7-3.el8 | RLSA-2024:3058 |
| Rocky Linux:9 | mutt | 5:2.2.6-2.el9 | RLSA-2024:2290 |
| Ubuntu:22.04:LTS | mutt | 2.1.4-1ubuntu1.2 | USN-6374-1 |
| Ubuntu:22.04:LTS | mutt | 2.1.4-1ubuntu1.2 | UBUNTU-CVE-2023-4874 |
Affected products (as reported)
Weakness: CWE-475 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
References
- https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch
- https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0.patch
- https://www.debian.org/security/2023/dsa-5494 x_transferred
- https://lists.debian.org/debian-lts-announce/2023/09/msg00021.html x_transferred
- http://www.openwall.com/lists/oss-security/2023/09/26/6 x_transferred