CVE-2018-14363: Path Traversal
An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-14363?
CVE-2018-14363 is a vulnerability discovered in NeoMutt before 2018-07-16 that allows the unrestricted use of '/' characters that may have unsafe interaction with cache pathnames.
How severe is CVE-2018-14363?
CVE-2018-14363 has a severity rating of 7.5 (high).
How can CVE-2018-14363 be fixed?
To fix CVE-2018-14363, update to one of the following versions: 1.10.1-2.1+deb10u6, 1.10.1-2.1+deb10u7, 2.0.5-4.1+deb11u3, 2.2.12-0.1~deb12u1, 2.2.9-1+deb12u1, or 2.2.12-0.1.
What software is affected by CVE-2018-14363?
The software affected by CVE-2018-14363 includes mutt versions 1.10.1-2.1+deb10u6, 1.10.1-2.1+deb10u7, 2.0.5-4.1+deb11u3, 2.2.12-0.1~deb12u1, 2.2.9-1+deb12u1, and 2.2.12-0.1, as well as neomutt versions 20180716+dfsg.1-1+deb10u2, 20180716+dfsg.1-1+deb10u1, 20201127+dfsg.1-1.2, and 20220429+dfsg1-4.1.
Is NeoMutt the only software affected by CVE-2018-14363?
No, the Debian Linux versions 8.0 and 9.0 are also affected by CVE-2018-14363.