Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
56 results · page 1 of 2
Oct 12, 2026A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path.CVE-2026-108094 · Other software · Red Hat · reported by Red HatHigh 7.8
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 8, 2026heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.CVE-2026-107570 · Other software · mutt · reported by cve@gitlab.comLow 2.5
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comopenwall.com
May 4, 2026mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.CVE-2026-43864 · Other software · mutt · reported by MITRELow 2.5
mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.CVE-2026-43863 · Other software · mutt · reported by MITRELow 3.7
mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026In mutt before 2.3.2, the imap_auth_gss security level is mishandled.CVE-2026-43862 · Other software · mutt · reported by MITRELow 3.7
In mutt before 2.3.2, the imap_auth_gss security level is mishandled.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026mutt before 2.3.2 does not check for '\0' in url_pct_decode.CVE-2026-43861 · Other software · mutt · reported by MITRELow 3.7
mutt before 2.3.2 does not check for '\0' in url_pct_decode.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.CVE-2026-43860 · Other software · mutt · reported by MITRELow 3.7
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.CVE-2026-43859 · Other software · mutt · reported by MITRELow 3.7
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.CVE-2024-49395 · Other software · Red Hat · reported by Red HatMedium 5.3
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 11, 2024In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed emaCVE-2024-49394 · Other software · Red Hat · reported by Red HatMedium 5.3
In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.
- Product
- Red Hat Enterprise Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 11, 2024In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their vCVE-2024-49393 · Other software · Red Hat · reported by Red HatMedium 6.5
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 9, 2023Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12CVE-2023-4875 · Other software · Mutt · reported by cve@gitlab.comLow 2.2
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2023Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12CVE-2023-4874 · Other software · Mutt · reported by cve@gitlab.comMedium 4.3
Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input lineCVE-2022-1328 · Other software · Mutt · reported by cve@gitlab.comMedium 4.3
Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2021Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in sCVE-2021-32055 · Other software · Mutt · reported by MITRECritical 9.1
Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.mutt.orggithub.com
Jan 19, 2021rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolCVE-2021-3181 · Other software · Mutt · reported by MITREMedium 6.5
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 23, 2020Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid.CVE-2020-28896 · Other software · Mutt · reported by MITREMedium 5.3
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2020Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3.CVE-2020-14954 · Other software · Mutt · reported by MITREMedium 5.9
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.mutt.orglists.opensuse.org
Jun 15, 2020Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.CVE-2020-14154 · Other software · Mutt · reported by MITREMedium 4.8
Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.mutt.orglists.opensuse.org
Jun 15, 2020Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.CVE-2020-14093 · Other software · Mutt · reported by MITREMedium 5.9
Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Nov 1, 2019Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.CVE-2005-2351 · Other software · mutt · reported by security@debian.orgMedium 5.5
Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecurity-tracker.debian.org
Jul 17, 2018An issue was discovered in NeoMutt before 2018-07-16.CVE-2018-14363 · Other software · Debian · reported by MITREHigh 7.5
An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14362 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmutt.orgaccess.redhat.com
Jul 17, 2018An issue was discovered in NeoMutt before 2018-07-16.CVE-2018-14361 · Other software · Debian · reported by MITRECritical 9.8
An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 17, 2018An issue was discovered in NeoMutt before 2018-07-16.CVE-2018-14360 · Other software · Debian · reported by MITRECritical 9.8
An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14359 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14358 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14357 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmutt.orgaccess.redhat.com
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14356 · Other software · Debian · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14355 · Other software · Debian · reported by MITREMedium 5.3
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14354 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmutt.orgsecurityfocus.com
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14353 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14352 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14351 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14350 · Other software · Mutt · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmutt.orgsecurityfocus.com
Jul 17, 2018An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.CVE-2018-14349 · Other software · Debian · reported by MITRECritical 9.8
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2014The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a CVE-2014-9116 · Other software · Suse · reported by MITREMedium 5
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Product
- Linux Enterprise Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.mageia.orgdev.mutt.org
Mar 14, 2014Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to addreCVE-2014-0467 · Other software · Mutt · reported by security@debian.orgMedium 5
Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 16, 2011Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to CVE-2011-1429 · Other software · Mutt · reported by MITREMedium 5.8
Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Oct 23, 2009mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an CVE-2009-3766 · Other software · Mutt · reported by MITREMedium 6.8
mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2009mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field oCVE-2009-3765 · Other software · Mutt · reported by MITREMedium 6.8
mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.mutt.orglists.opensuse.org
Jun 16, 2009Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is acCVE-2009-1390 · Other software · Mutt · reported by Red HatMedium 6.8
Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.mutt.orgdev.mutt.org
Dec 8, 2008muttprint in muttprint 0.72d allows local users to overwrite arbitrary files via a symlink attack on the /tmp/muttprint.log temporary file.CVE-2008-5368 · Other software · Lukas RUF · reported by MITREMedium 6.9
muttprint in muttprint 0.72d allows local users to overwrite arbitrary files via a symlink attack on the /tmp/muttprint.log temporary file.
- Product
- Muttprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecunia.com
May 15, 2007Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias CVE-2007-2683 · Other software · Mutt · reported by MITRELow 3.5
Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2007Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and CVE-2007-1268 · Other software · Mutt · reported by MITREMedium 5
Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.gnupg.orgsecunia.com
Oct 16, 2006Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to oCVE-2006-5297 · Other software · Mutt · reported by MITRELow 1.2
Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2006The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissiCVE-2006-5298 · Other software · Mutt · reported by MITRELow 1.2
The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2006Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of serviCVE-2006-3242 · Other software · Mutt · reported by MITREHigh 7.5
Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpatches.sgi.comdev.mutt.org
Aug 23, 2005Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions wiCVE-2005-2642 · Other software · Mutt · reported by MITREHigh 7.5
Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions with libiconv or gettext.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcomments.gmane.orgonline.securityfocus.com
Mar 3, 2004Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and pCVE-2004-0078 · Other software · Mutt · reported by MITREHigh 7.5
Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages.
- Product
- Mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.caldera.combugs.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.