DSA-3083-1: mutt - Denial of Service Vulnerability
Summary
DSA-3083-1: mutt - security update. Affects mutt versions < 1.5.21-6.2+deb7u3. Fixed in 1.5.21-6.2+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mutt is a text-based mailreader commonly used in Linux distributions. It provides a command-line interface for reading, composing, and managing email. The vulnerability identified in mutt allows an attacker to craft a malicious mail header that can cause the application to crash, resulting in a denial of service (DoS) condition.
Vulnerability Detail
The vulnerability in mutt arises from a flaw in the processing of mail headers. By sending a specially crafted mail header, an attacker can trigger a crash in mutt, leading to a DoS situation. This vulnerability can be exploited remotely, without requiring any authentication. The impact of this vulnerability is limited to a DoS, and there is no evidence of it leading to remote code execution or data leakage.
How To Fix
Minimum fixed version
1.5.21-6.2+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading the mutt package to the patched version.
Conclusion
The mutt package is vulnerable to a denial of service (DoS) attack caused by a flaw in the processing of mail headers. To mitigate this vulnerability, users should upgrade their mutt packages to the recommended versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mutt →
FAQ
The vulnerability allows an attacker to crash the mutt application, resulting in a denial of service (DoS) condition. However, there is no evidence of it leading to remote code execution or data leakage.
Yes, this vulnerability can be exploited remotely without requiring any authentication.
No, there is no known workaround. It is crucial to apply the provided fix by upgrading the mutt package.
The vulnerability affects mutt versions prior to 1.5.21-6.2+deb7u3 for the Debian 7 (wheezy) distribution.
Users can update their mutt packages using the package manager of their respective distributions. For Debian 7 (wheezy), upgrade to version 1.5.21-6.2+deb7u3.
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
