Critical Buffer Overflow Vulnerability in Mutt Package (CVE-2018-14358)
Summary
ALPINE-CVE-2018-14358: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a small but very powerful text-based mail client for Unix operating systems. It supports various mailbox formats and is known for its flexibility and configurability. However, prior to version 1.10.1, Mutt was vulnerable to a stack-based buffer overflow, which could be exploited through maliciously crafted email messages, particularly those with long RFC822.SIZE fields.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14358, originates from a flaw in the imap/message.c file of Mutt and NeoMutt, where a buffer overflow occurs during the processing of FETCH responses. This can lead to arbitrary code execution, potentially allowing an attacker to gain control over the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the severe impact it could have on confidentiality, integrity, and availability.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening emails from untrusted sources or disable IMAP fetching until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The CVE-2018-14358 vulnerability in Mutt poses a significant risk due to its potential for exploitation via buffer overflow. Users are strongly advised to update to the latest version to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for mutt →
FAQ
CVE-2018-14358 is a critical vulnerability in Mutt that allows for a stack-based buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete control over the affected system.
Yes, the vulnerability is patched in version 1.10.1-r0 of Mutt. Users should update to this version or later.
If immediate updating is not possible, avoid opening emails from untrusted sources and consider disabling IMAP fetching as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
