Errata overview
Errata ID 468
Date 2018-08-15
Source package mutt
Fixed in version 1.5.23-3+deb8u1
Description
This update addresses the following issues:
* Heap Overflow in imap/command.c (CVE-2018-14349)
* stack-based buffer overflow in imap/message.c (CVE-2018-14350)
* IMAP status mailbox literal mishandled in imap/command.c (CVE-2018-14351)
* stack-based buffer overflow in imap/util.c (CVE-2018-14352)
* integer underflow in imap/util.c (CVE-2018-14353)
* Remote code injection vulnerability to an IMAP mailbox (CVE-2018-14354)
* IMAP header caching path traversal vulnerability (CVE-2018-14355)
* mishandles a zero-length UID in pop.c (CVE-2018-14356)
* Remote Code Execution via backquote characters (CVE-2018-14357)
* stack-based buffer overflow in imap/message.c (CVE-2018-14358)
* buffer overflow via base64 data (CVE-2018-14359)
* Fix a stack-based buffer overflow because of incorrect sscanf usage
  (CVE-2018-14360)
* Fix a defect where processing continues if memory allocation fails for NNTP
  messages (CVE-2018-14361)
* POP body caching path traversal vulnerability (CVE-2018-14362)
* newsrc.c does not properly restrict '/' characters that may have unsafe
  interaction with cache pathnames. (CVE-2018-14363)
Additional notes
CVE ID CVE-2018-14349
CVE-2018-14350
CVE-2018-14351
CVE-2018-14352
CVE-2018-14353
CVE-2018-14354
CVE-2018-14355
CVE-2018-14356
CVE-2018-14357
CVE-2018-14358
CVE-2018-14359
CVE-2018-14360
CVE-2018-14361
CVE-2018-14362
CVE-2018-14363
UCS Bug number #47521