- Vulnerability/
- USN-7204-1
USN-7204-1: NeoMutt vulnerabilities
First published: Wed Jan 15 2025(Updated: )
Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362) Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363) It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896) It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055) Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328) It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/neomutt | <20231103+dfsg1-1ubuntu0.1~esm1 | 20231103+dfsg1-1ubuntu0.1~esm1 |
| Ubuntu Ubuntu | =24.04 | |
| All of | ||
| ubuntu/neomutt | <20211029+dfsg1-1ubuntu0.1~esm1 | 20211029+dfsg1-1ubuntu0.1~esm1 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/neomutt | <20191207+dfsg.1-1.1ubuntu0.1~esm1 | 20191207+dfsg.1-1.1ubuntu0.1~esm1 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/neomutt | <20171215+dfsg.1-1ubuntu0.1~esm1 | 20171215+dfsg.1-1ubuntu0.1~esm1 |
| Ubuntu Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2018-14361
- https://ubuntu.com/security/CVE-2020-28896
- https://ubuntu.com/security/CVE-2021-32055
- https://ubuntu.com/security/CVE-2018-14355
- https://ubuntu.com/security/CVE-2018-14357
- https://ubuntu.com/security/CVE-2018-14363
- https://ubuntu.com/security/CVE-2018-14362
- https://ubuntu.com/security/CVE-2018-14356
- https://ubuntu.com/security/CVE-2024-49394
- https://ubuntu.com/security/CVE-2018-14349
- https://ubuntu.com/security/CVE-2018-14360
- https://ubuntu.com/security/CVE-2018-14351
- https://ubuntu.com/security/CVE-2018-14354
- https://ubuntu.com/security/CVE-2018-14352
- https://ubuntu.com/security/CVE-2018-14359
- https://ubuntu.com/security/CVE-2024-49393
- https://ubuntu.com/security/CVE-2018-14358
- https://ubuntu.com/security/CVE-2018-14353
- https://ubuntu.com/security/CVE-2018-14350
- https://ubuntu.com/security/CVE-2022-1328
- https://ubuntu.com/security/CVE-2020-14954
- https://ubuntu.com/security/notices/USN-4645-1
- https://ubuntu.com/security/notices/USN-5392-1
- https://ubuntu.com/security/notices/USN-3719-2
- https://ubuntu.com/security/notices/USN-3719-1
- https://ubuntu.com/security/notices/USN-3719-3
- https://ubuntu.com/security/notices/USN-4403-1
- https://ubuntu.com/security/notices/USN-7204-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/title
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/softwarecombine
- agent/event
- agent/type
- agent/description
- agent/tags
- agent/source
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/24.04
- version/ubuntu ubuntu/22.04
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04