Stay Secure with the Latest Linux Advisories

security advisorydenial of servicecode execution

Ubuntu 24.04 LTS Security Advisory: USN-7204-1 Addresses NeoMutt DoS

Several security issues were fixed in NeoMutt.. ========================================================================== Ubuntu Security Notice USN-7204-1 January 15, 2025 neomutt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in NeoMutt. Software Description: - neomutt: command line mail reader based on Mutt, with added features Details: Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362) Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363) It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896) It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055) Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. Anattacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328) It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS neomutt 20231103+dfsg1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS neomutt 20211029+dfsg1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS neomutt 20191207+dfsg.1-1.1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS neomutt 20171215+dfsg.1-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7204-1 CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14360, CVE-2018-14361, CVE-2018-14362, CVE-2018-14363, CVE-2020-14954, CVE-2020-28896, CVE-2021-32055, CVE-2022-1328, CVE-2024-49393, CVE-2024-49394 . Recent updates target NeoMutt security vulnerabilities in Ubuntu, impacting several LTS releases. Ensure vital patches are applied.. NeoMutt Security, Ubuntu Security Updates, Mail Client Vulnerabilities, System Security Maintenance. . Severity: Important. LinuxSecurity.com Team

Jan 15, 2025 •Important Ubuntu