A heap overflow vulnerability was found in openslp, that may result in remote code execution.

A flaw was found in mutt before 1.10.1. There is a path traversal flaw for UID values in POP bcache directory.

References:

http://www.mutt.org/news.html https://gitlab.com/muttmua/mutt/blob/master/ChangeLog

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.

A flaw was found in mutt before 1.10.1. When "subscribing" to an IMAP mailbox, either via $imapchecksubscribed, or via the <subscribe> function in the browser menu, the lack of proper input parsing may lead to remote code injection from a malicous IMAP server.

Upstream patch:

References:

http://www.mutt.org/news.html https://gitlab.com/muttmua/mutt/blob/master/ChangeLog