Buffer Overflow Vulnerability in Mutt Package - CVE-2018-14352
Summary
ALPINE-CVE-2018-14352: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular text-based email client known for its flexibility and powerful features. It supports various protocols, including IMAP, POP3, and SMTP, allowing users to manage their emails efficiently. However, prior to version 1.10.1, Mutt contained a vulnerability that could lead to a stack-based buffer overflow, compromising the security of the application.
Vulnerability Detail
An issue was discovered in Mutt before version 1.10.1 and NeoMutt before July 16, 2018. The vulnerability lies in the imap_quote_string function within imap/util.c, which fails to allocate sufficient space for quote characters. This oversight can lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code, disrupt service, or gain unauthorized access to sensitive information. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the IMAP functionality of Mutt until the package is updated. This can help mitigate the risk of exploitation while waiting for the patch to be applied.
Conclusion
The vulnerability CVE-2018-14352 in the Mutt email client poses a significant security risk due to a stack-based buffer overflow. Users are strongly advised to update to version 1.10.1-r0 or later to protect their systems. For those unable to update immediately, disabling IMAP functionality is recommended as a temporary measure.
See every vulnerability recorded for mutt →
FAQ
CVE-2018-14352 is a vulnerability in the Mutt email client that can lead to a stack-based buffer overflow due to insufficient space for quote characters in the imap_quote_string function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, service disruption, or unauthorized access to sensitive information.
Yes, the patched version of Mutt is 1.10.1-r0. Users should update to this version or later to mitigate the vulnerability.
If an immediate update is not possible, consider disabling the IMAP functionality of Mutt as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
