Stay Secure with the Latest Linux Advisories

security advisorydenial of servicemedium severity

Arch Linux ASA-201503-6 Medium: Mutt Denial Of Service Threat

The package mutt before version 1.5.23-2 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-201503-6 ======================================== Severity: Medium Date : 2015-03-09 CVE-ID : CVE-2014-9116 Package : mutt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package mutt before version 1.5.23-2 is vulnerable to denial of service. Resolution ========= Upgrade to 1.5.23-2. # pacman -Syu "mutt> =1.5.23-2" The problem has been fixed upstream but no release is available yet. Workaround ========= None. Description ========== The write_one_header function does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function. Impact ===== A remote attacker is able to send mails with specially crafted headers that leads to a crash resulting in denial of service. References ========= https://seclists.org/oss-sec/2014/q4/835 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9116 https://bugs.archlinux.org/task/44110 . Debian Security Bulletin warns of a moderate risk vulnerability in the vim package caused by specially constructed files.. mutt security, Arch Linux advisory, denial of service threat. . Severity: Medium. LinuxSecurity.com Team

Mar 09, 2015 •Medium ArchLinux