Every CVE Search/ Get API key

CVE-2018-14354

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote...

9.8 CriticalFix available

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.15%Up 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
CVE-2018-14354
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-78
Updated
2026-11-02
CVE List No score

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
CVE-2018-14354
Updated
2026-11-02
EUVDEUVD-2018-6275 No score

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
EUVD-2018-6275
Updated
2026-11-03
GitHub AdvisoriesGHSA-5hcq-hmph-mw8w 9.8

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote...

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
GHSA-5hcq-hmph-mw8w
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVALPINE-CVE-2018-14354 9.8

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
ALPINE-CVE-2018-14354
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
CVE-2018-14354
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2018-14354 9.8

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
DEBIAN-CVE-2018-14354
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:2526 9.6

Red Hat Security Advisory: mutt security update

Record
RHSA-2018:2526
CVSS 3.0
9.6 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-14354 9.8

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

Record
UBUNTU-CVE-2018-14354
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0447 No score

Updated mutt packages fix security vulnerability

It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this to execute arbitrary code (CVE-2018-14350, CVE-2018-14352, CVE-2018-14354, CVE-2018-14359, CVE-2018-14358, CVE-2018-14353 ,CVE-2018-14357).

It was discovered that Mutt incorrectly handled certain inputs. An attacker could possibly use this to access or expose sensitive information (CVE-2018-14355, CVE-2018-14356, CVE-2018-14351, CVE-2018-14362, CVE-2018-14349).

nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage (CVE-2018-14360).

nntp.c proceeds even if memory allocation fails for messages data (CVE-2018-14361).

newsrc.c does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (CVE-2018-14363).

Record
MGASA-2018-0447
Updated
2026-11-02
OSVopenSUSE-SU-2024:11069-1 No score

mutt-2.0.7-2.2 on GA media

These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11069-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11079-1 No score

neomutt-20210205-3.3 on GA media

These are all security issues fixed in the neomutt-20210205-3.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11079-1
Updated
2026-11-02
OSVSUSE-SU-2018:2084-1 No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • bsc#1101428: Mutt 1.10.1 security release update.
  • CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
  • CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes:

  • mutt reports as neomutt and incorrect version (bsc#1094717)
  • No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
  • mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
  • (neo)mutt displaying times in Zulu time (bsc#1061343)
  • mutt unconditionally segfaults when displaying a message (bsc#986534)
Record
SUSE-SU-2018:2084-1
Updated
2026-11-02
OSVSUSE-SU-2018:2085-1 No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • bsc#1101428: Mutt 1.10.1 security release update.
  • CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
  • CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes:

  • mutt reports as neomutt and incorrect version (bsc#1094717)
Record
SUSE-SU-2018:2085-1
Updated
2026-11-02
OSVSUSE-SU-2018:2403-1 No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).

Bug fixes:

  • bsc#936807: On entering a 70 character subject line in mutt, a tab is added to the text after 67 characters.
Record
SUSE-SU-2018:2403-1
Updated
2026-11-02
OSVSUSE-SU-2019:1196-1 No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • bsc#1101428: Mutt 1.10.1 security release update.
  • CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
  • CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes:

  • mutt reports as neomutt and incorrect version (bsc#1094717)
  • No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
  • mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
  • (neo)mutt displaying times in Zulu time (bsc#1061343)
  • mutt unconditionally segfaults when displaying a message (bsc#986534)
Record
SUSE-SU-2019:1196-1
Updated
2026-11-02
OSVUSN-3719-1 No score

mutt vulnerabilities

It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this to execute arbitrary code. (CVE-2018-14350, CVE-2018-14352, CVE-2018-14354, CVE-2018-14359, CVE-2018-14358, CVE-2018-14353 ,CVE-2018-14357)

It was discovered that Mutt incorrectly handled certain inputs. An attacker could possibly use this to access or expose sensitive information. (CVE-2018-14355, CVE-2018-14356, CVE-2018-14351, CVE-2018-14362, CVE-2018-14349)

Record
USN-3719-1
Updated
2026-11-02
OSVUSN-3719-3 No score

mutt vulnerabilities

USN-3719-1 fixed vulnerabilities in Mutt. Unfortunately, the fixes were not correctly applied to the packaging for Mutt in Ubuntu 16.04 LTS. This update corrects the oversight.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this to execute arbitrary code. (CVE-2018-14350, CVE-2018-14352, CVE-2018-14354, CVE-2018-14359, CVE-2018-14358, CVE-2018-14353 ,CVE-2018-14357)

It was discovered that Mutt incorrectly handled certain inputs. An attacker could possibly use this to access or expose sensitive information. (CVE-2018-14355, CVE-2018-14356, CVE-2018-14351, CVE-2018-14362, CVE-2018-14349)

Record
USN-3719-3
Updated
2026-11-02
OSVUSN-7204-1 No score

neomutt vulnerabilities

Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)

Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)

It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)

It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328)

It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)

Record
USN-7204-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
Alpine:v3.5
 before 1.10.1-r0
1.10.1-r0
mutt
Alpine:v3.6
 before 1.10.1-r0
1.10.1-r0
mutt
Alpine:v3.7
 before 1.10.1-r0
1.10.1-r0
mutt
Alpine:v3.8
 before 1.10.1-r0
1.10.1-r0
mutt
Debian:12
 before 1.10.1-1
1.10.1-1
mutt
Debian:13
 before 1.10.1-1
1.10.1-1
mutt
Debian:14
 before 1.10.1-1
1.10.1-1
neomutt
Debian:12
 before 20180716+dfsg.1-1
20180716+dfsg.1-1
neomutt
Debian:13
 before 20180716+dfsg.1-1
20180716+dfsg.1-1
neomutt
Debian:14
 before 20180716+dfsg.1-1
20180716+dfsg.1-1
Show 45 moreShow less
Affected packages
PackageAffectedFixed
mutt
Debian:8
From an advisory covering 15 CVEs
 before 1.5.23-3+deb8u1, plus listed versions
1.5.23-3
1.5.23-3+deb8u1
mutt
Debian:9
From an advisory covering 15 CVEs
 before 1.7.2-1+deb9u1, plus listed versions
1.7.2-1
1.7.2-1+deb9u1
mutt
Mageia:6
From an advisory covering 15 CVEs
 before 1.10.1-1.1.mga6
1.10.1-1.1.mga6
mutt
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 5:1.5.20-9.20091214hg736b6a.el6
5:1.5.20-9.20091214hg736b6a.el6
mutt
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 5:1.5.21-28.el7_5
5:1.5.21-28.el7_5
mutt
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 16 CVEs
 before 1.10.1-55.3.1
1.10.1-55.3.1
mutt
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 16 CVEs
 before 1.10.1-55.3.1
1.10.1-55.3.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 16 CVEs
 before 1.10.1-55.3.1
1.10.1-55.3.1
mutt
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 16 CVEs
 before 1.10.1-3.3.4
1.10.1-3.3.4
mutt
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 11 CVEs
 before 1.5.17-42.43.1
1.5.17-42.43.1
mutt
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 11 CVEs
 before 1.5.17-42.43.1
1.5.17-42.43.1
mutt
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 11 CVEs
 before 1.5.17-42.43.1
1.5.17-42.43.1
mutt
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 11 CVEs
 before 1.5.17-42.43.1
1.5.17-42.43.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 11 CVEs
 before 1.5.17-42.43.1
1.5.17-42.43.1
mutt
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 16 CVEs
 before 1.10.1-55.6.1
1.10.1-55.6.1
mutt
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 16 CVEs
 before 1.10.1-55.6.1
1.10.1-55.6.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 16 CVEs
 before 1.10.1-55.6.1
1.10.1-55.6.1
mutt
Ubuntu:14.04:LTS
 before 1.5.21-6.4ubuntu2.2, plus listed versions
1.5.21-6.4ubuntu11.5.21-6.4ubuntu21.5.21-6.4ubuntu2.1
1.5.21-6.4ubuntu2.2
mutt
Ubuntu:16.04:LTS
 before 1.5.24-1ubuntu0.2, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
1.5.24-1ubuntu0.2
mutt
Ubuntu:18.04:LTS
 before 1.9.4-3ubuntu0.1, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 4 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-3
1.9.4-3ubuntu0.1
neomutt
Ubuntu:Pro:18.04:LTS
 before 20171215+dfsg.1-1ubuntu0.1~esm1, plus listed versions
20171027-120171027-220171027+dfsg.1-120171027+dfsg.1-220171027+dfsg.1-420171208+dfsg.1-120171208+dfsg.1-220171215+dfsg.1-1
20171215+dfsg.1-1ubuntu0.1~esm1
mutt
Ubuntu:14.04:LTS
From an advisory covering 12 CVEs
 before 1.5.21-6.4ubuntu2.2, plus listed versions
1.5.21-6.4ubuntu11.5.21-6.4ubuntu21.5.21-6.4ubuntu2.1
1.5.21-6.4ubuntu2.2
mutt
Ubuntu:16.04:LTS
From an advisory covering 12 CVEs
 before 1.5.24-1ubuntu0.1, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build1
1.5.24-1ubuntu0.1
mutt
Ubuntu:18.04:LTS
From an advisory covering 12 CVEs
 before 1.9.4-3ubuntu0.1, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 4 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-3
1.9.4-3ubuntu0.1
mutt
Ubuntu:16.04:LTS
From an advisory covering 12 CVEs
 before 1.5.24-1ubuntu0.2, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
1.5.24-1ubuntu0.2
neomutt
Ubuntu:Pro:18.04:LTS
From an advisory covering 21 CVEs
 before 20171215+dfsg.1-1ubuntu0.1~esm1, plus listed versions
20171027-120171027-220171027+dfsg.1-120171027+dfsg.1-220171027+dfsg.1-420171208+dfsg.1-120171208+dfsg.1-220171215+dfsg.1-1
20171215+dfsg.1-1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:20.04:LTS
From an advisory covering 21 CVEs
 before 20191207+dfsg.1-1.1ubuntu0.1~esm1, plus listed versions
20180716+dfsg.1-1.220191111+dfsg.1-120191207+dfsg.1-1.1
20191207+dfsg.1-1.1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:22.04:LTS
From an advisory covering 21 CVEs
 before 20211029+dfsg1-1ubuntu0.1~esm1, plus listed versions
20201127+dfsg.1-1.220211029+dfsg1-1
20211029+dfsg1-1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:24.04:LTS
From an advisory covering 21 CVEs
 before 20231103+dfsg1-1ubuntu0.1~esm1, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120231103+dfsg1-1build220231103+dfsg1-1build3
20231103+dfsg1-1ubuntu0.1~esm1
mutt
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 2.0.7-2.2
2.0.7-2.2
neomutt
openSUSE:Tumbleweed
From an advisory covering 19 CVEs
 before 20210205-3.3
20210205-3.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-14354 is a critical vulnerability (CVSS 9.8) in Mutt, published July 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.15%, the 93rd percentile. Fixed in mutt 1.10.1-r0.

References

Show 101 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open