[SECURITY] [DSA 4708-1] neomutt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4708-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 21, 2020 https://www.debian.org/security/faq -...

CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

DEBIAN-CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

UBUNTU-CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

Design/Logic Flaw

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

EUVD-2020-7089

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

CVE-2020-14954

CVE-2020-14954 affects mutt before 1.14.4 and NeoMutt before 2020-06-19. A STARTTLS buffering issue causes the client to read extra data after a server "begin TLS" response and evaluate it in a TLS context, enabling potential man‑in‑the‑middle (MITM) exploitation during IMAP/SMTP/POP3. The issue ...

CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a man-in-the-middle attacker and evaluates it in a TLS context, aka "response injection."...

DSA-4708-1 neomutt - security update

Bulletin has no description...

PT-2020-5911 · Mutt +5 · Mutt +5

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.14.4 NeoMutt versions prior to 2020-06-19 Description: The issue is related to a STARTTLS buffering problem that affects IMAP, SMTP, and POP3 protocols. When a server sends a "begin TLS" response, the client reads...

neomutt:address-fuzz: Heap-buffer-overflow in next_token

Project: https://github.com/neomutt/neomutt.git Detailed Report: https://oss-fuzz.com/testcase?key=5091592003387392 Project: neomutt Fuzzing Engine: libFuzzer Fuzz Target: address-fuzz Job Type: libfuzzerasanneomutt Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

neomutt:address-fuzz: Stack-buffer-overflow in mutt_addrlist_parse

Project: https://github.com/neomutt/neomutt.git Detailed Report: https://oss-fuzz.com/testcase?key=5731491599613952 Project: neomutt Fuzzing Engine: libFuzzer Fuzz Target: address-fuzz Job Type: libfuzzerasanneomutt Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash Address:...

EulerOS 2.0 SP3 : mutt (EulerOS-SA-2020-1412)

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.CVE-2018-143...

mutt: IMAP header caching path traversal vulnerability

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name...

Huawei EulerOS: Security Advisory for mutt (EulerOS-SA-2019-2508)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerabilities of Mutt and NeoMutt email clients, related to errors in processing input data, allow a hacker to execute arbitrary code.

The vulnerability of Mutt and NeoMutt email clients is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Mutt and NeoMutt email clients, related to buffer overflows, allows attackers to execute arbitrary code.

The vulnerability of Mutt and NeoMutt email clients is related to buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...