USN-7204-1

Dashboard / Vulnerabilities / USN-7204-1

USN-7204-1

Summary: neomutt vulnerabilities

Details: Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362) Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363) It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896) It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055) Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328) It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)

References: https://ubuntu.com/security/notices/USN-7204-1, https://ubuntu.com/security/CVE-2018-14349, https://ubuntu.com/security/CVE-2018-14350, https://ubuntu.com/security/CVE-2018-14351, https://ubuntu.com/security/CVE-2018-14352, https://ubuntu.com/security/CVE-2018-14353, https://ubuntu.com/security/CVE-2018-14354, https://ubuntu.com/security/CVE-2018-14355, https://ubuntu.com/security/CVE-2018-14356, https://ubuntu.com/security/CVE-2018-14357, https://ubuntu.com/security/CVE-2018-14358, https://ubuntu.com/security/CVE-2018-14359, https://ubuntu.com/security/CVE-2018-14360, https://ubuntu.com/security/CVE-2018-14361, https://ubuntu.com/security/CVE-2018-14362, https://ubuntu.com/security/CVE-2018-14363, https://ubuntu.com/security/CVE-2020-14954, https://ubuntu.com/security/CVE-2020-28896, https://ubuntu.com/security/CVE-2021-32055, https://ubuntu.com/security/CVE-2022-1328, https://ubuntu.com/security/CVE-2024-49393, https://ubuntu.com/security/CVE-2024-49394