Ubuntu 13.10 USN-2147-1 Critical: Mutt Denial of Service Threat

ubuntu

March 13, 2014

The mutt mail client could be made to crash or run programs as yourlogin if it opened a specially crafted email.

Summary

The mutt mail client could be made to crash or run programs as your

Software Description:

- mutt: text-based mailreader supporting MIME, GPG, PGP and threading

Details:

Beatrice Torracca and Evgeni Golov discovered a buffer overflow

in mutt while expanding addresses when parsing email headers. An

attacker could specially craft an email to cause mutt to crash,

resulting in a denial of service, or possibly execute arbitrary code

with the privileges of the user invoking mutt.

Topics Covered

security advisory denial of service security issue buffer overflow software update ubuntu mutt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  mutt                            1.5.21-6.4ubuntu1.1
  mutt-patched                    1.5.21-6.4ubuntu1.1

Ubuntu 12.10:
  mutt                            1.5.21-6ubuntu0.1
  mutt-patched                    1.5.21-6ubuntu0.1

Ubuntu 12.04 LTS:
  mutt                            1.5.21-5ubuntu2.1
  mutt-patched                    1.5.21-5ubuntu2.1

Ubuntu 10.04 LTS:
  mutt                            1.5.20-7ubuntu1.2
  mutt-patched                    1.5.20-7ubuntu1.2

After a standard system update you need to restart mutt to make
all the necessary changes.