Gentoo: GLSA-202105-05: Mutt, NeoMutt: Denial of Service | LinuxSec...

Advisories

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202105-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Low
     Title: Mutt, NeoMutt: Denial of Service
      Date: May 26, 2021
      Bugs: #788388, #788391
        ID: 202105-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability in Mutt and NeoMutt could lead to a Denial of Service
condition.

Background
==========

Mutt is a small but very powerful text-based mail client.

NeoMutt is a command line mail reader (or MUA). It's a fork of Mutt
with added features.

Affected packages
=================

     -------------------------------------------------------------------
      Package              /     Vulnerable     /            Unaffected
     -------------------------------------------------------------------
   1  mail-client/mutt             < 2.0.7                    >= 2.0.7
   2  mail-client/neomutt       < 20210205-r1           >= 20210205-r1
     -------------------------------------------------------------------
      2 affected packages

Description
===========

It was discovered that Mutt, and NeoMutt did not properly handle
certain situations where an IMAP sequence set ends with a comma.

Impact
======

A remote attacker could entice a user to connect to a malicious IMAP
server to cause a Denial of Service condition, or other unspecified
impacts.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Mutt users should upgrade to the latest version:

   # emerge --sync
   # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.7"

All NeoMutt users should upgrade to the latest version:

   # emerge --sync
   # emerge --ask --oneshot -v ">=mail-client/neomutt-20210205-r1"

References
==========

[ 1 ] CVE-2021-32055
       https://nvd.nist.gov/vuln/detail/CVE-2021-32055

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  https://security.gentoo.org/glsa/202105-05

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2021 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo: GLSA-202105-05: Mutt, NeoMutt: Denial of Service

Summary

It was discovered that Mutt, and NeoMutt did not properly handle certain situations where an IMAP sequence set ends with a comma.

Resolution

All Mutt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/mutt-2.0.7"
All NeoMutt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=mail-client/neomutt-20210205-r1"

References

[ 1 ] CVE-2021-32055 https://nvd.nist.gov/vuln/detail/CVE-2021-32055

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202105-05

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: Low
Title: Mutt, NeoMutt: Denial of Service
Issued Date: May 26, 2021
Bugs: #788388, #788391
ID: 202105-05

Synopsis

A vulnerability in Mutt and NeoMutt could lead to a Denial of Service condition.

Background

Mutt is a small but very powerful text-based mail client.
NeoMutt is a command line mail reader (or MUA). It's a fork of Mutt with added features.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-client/mutt < 2.0.7 >= 2.0.7 2 mail-client/neomutt < 20210205-r1 >= 20210205-r1 ------------------------------------------------------------------- 2 affected packages

Impact

A remote attacker could entice a user to connect to a malicious IMAP server to cause a Denial of Service condition, or other unspecified impacts.

Workaround

There is no known workaround at this time.

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.