Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade muttUpgrade neomutt | Aug 22, 2024 | May 5, 2021 |
| Debian | — | Upgrade neomuttUpgrade mutt | Jul 30, 2024 | May 5, 2021 |
| Gentoo Linux | — | Upgrade mail-client/mutt.Upgrade mail-client/neomutt. | May 28, 2021 | May 5, 2021 |
| Oracle Solaris | — | Upgrade mail/mutt to version 2.0.7-11.4.35.0.1.94.2 on Solaris 11.4 | Jul 21, 2021 | May 5, 2021 |
| Suse | — | Upgrade neomuttUpgrade neomutt-langUpgrade neomutt-doc | Oct 26, 2022 | May 5, 2021 |
| Ubuntu | — | Upgrade muttUpgrade neomutt (Ubuntu Pro) | Apr 29, 2022 | May 5, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub