CVE-2014-9116
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the...
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
Exploit likelihood
What each source reports
NVD Score used
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
CVE-2014-9116- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
CVE-2014-9116- Updated
- 2026-11-02
EUVDEUVD-2014-8942 No score
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
EUVD-2014-8942- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mv99-5p2c-93vv No score
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the...
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
GHSA-mv99-5p2c-93vv- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
CVE-2014-9116- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9116 No score
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
DEBIAN-CVE-2014-9116- Updated
- 2026-11-02
Show 8 moreShow less
OSVMGASA-2014-0509 No score
Updated mutt packages fix CVE-2014-9116
Updated mutt packages fix security vulnerability:
A flaw was discovered in mutt. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition (CVE-2014-9116).
The mutt package has been updated to version 1.5.23 and patched to fix this issue.
- Record
MGASA-2014-0509- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10198-1 No score
mutt-1.6.2-3.1 on GA media
These are all security issues fixed in the mutt-1.6.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10198-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0758-1 No score
Security update for mutt
The mailreader mutt was updated to fix a security issue in displaying mail headers, where a crafted e-mail could cause a heap overflow, which in turn might be used by attackers to crash mutt or potentially even execute code.
Security Issues references:
* CVE-2014-0467
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467>
- Record
SUSE-SU-2015:0758-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2084-1 No score
Security update for mutt
This update for mutt fixes the following issues:
Security issues fixed:
- bsc#1101428: Mutt 1.10.1 security release update.
- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).
Bug fixes:
- mutt reports as neomutt and incorrect version (bsc#1094717)
- No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
- mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
- (neo)mutt displaying times in Zulu time (bsc#1061343)
- mutt unconditionally segfaults when displaying a message (bsc#986534)
- Record
SUSE-SU-2018:2084-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2085-1 No score
Security update for mutt
This update for mutt fixes the following issues:
Security issues fixed:
- bsc#1101428: Mutt 1.10.1 security release update.
- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).
Bug fixes:
- mutt reports as neomutt and incorrect version (bsc#1094717)
- Record
SUSE-SU-2018:2085-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1196-1 No score
Security update for mutt
This update for mutt fixes the following issues:
Security issues fixed:
- bsc#1101428: Mutt 1.10.1 security release update.
- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).
Bug fixes:
- mutt reports as neomutt and incorrect version (bsc#1094717)
- No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
- mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
- (neo)mutt displaying times in Zulu time (bsc#1061343)
- mutt unconditionally segfaults when displaying a message (bsc#986534)
- Record
SUSE-SU-2019:1196-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9116 No score
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
- Record
UBUNTU-CVE-2014-9116- Updated
- 2026-11-02
OSVUSN-2440-1 No score
mutt vulnerability
Jakub Wilk discovered that the write_one_header function in mutt did not properly handle newline characters at the beginning of a header. An attacker could specially craft an email to cause mutt to crash, resulting in a denial of service.
- Record
USN-2440-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
muttDebian:12 |
before 1.5.23-2 | 1.5.23-2 |
muttDebian:13 |
before 1.5.23-2 | 1.5.23-2 |
muttDebian:14 |
before 1.5.23-2 | 1.5.23-2 |
muttDebian:6.0 |
before 1.5.20-9+squeeze4, plus listed versions 1.5.20-9+squeeze11.5.20-9+squeeze21.5.20-9+squeeze3 |
1.5.20-9+squeeze4 |
muttDebian:7 |
before 1.5.21-6.2+deb7u3, plus listed versions 1.5.21-6.21.5.21-6.2+deb7u11.5.21-6.2+deb7u21.5.21-6.2+deb7u2~bpo60+1 |
1.5.21-6.2+deb7u3 |
muttMageia:4 |
before 1.5.23-1.mga4 | 1.5.23-1.mga4 |
muttSUSE:Linux Enterprise Desktop 12 SP3 |
before 1.10.1-55.3.1 | 1.10.1-55.3.1 |
muttSUSE:Linux Enterprise Server 12 SP3 |
before 1.10.1-55.3.1 | 1.10.1-55.3.1 |
muttSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.10.1-55.3.1 | 1.10.1-55.3.1 |
muttSUSE:Linux Enterprise Module for Basesystem 15 |
before 1.10.1-3.3.4 | 1.10.1-3.3.4 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
muttSUSE:Linux Enterprise Desktop 12 SP3 |
before 1.10.1-55.6.1 | 1.10.1-55.6.1 |
muttSUSE:Linux Enterprise Server 12 SP3 |
before 1.10.1-55.6.1 | 1.10.1-55.6.1 |
muttSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.10.1-55.6.1 | 1.10.1-55.6.1 |
muttUbuntu:14.04:LTS |
before 1.5.21-6.4ubuntu2.1, plus listed versions 1.5.21-6.4ubuntu11.5.21-6.4ubuntu2 |
1.5.21-6.4ubuntu2.1 |
muttopenSUSE:Tumbleweed |
before 1.6.2-3.1 | 1.6.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9116 is a medium vulnerability (CVSS 5.0) in Mutt, published March 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.69%, the 95th percentile. Fixed in mutt 1.5.23-2.
References
bugzilla.redhat.com/show_bug.cgi?id=1168463
bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125
lists.opensuse.org/opensuse-security-announce/2015-01/msg00002.html
securitytracker.com/id/1031266
dev.mutt.org/trac/ticket/3716
openwall.com/lists/oss-security/2014/11/27/5
Show 59 moreShow less
mandriva.com/security/advisories?name=MDVSA-2015:078
advisories.mageia.org/MGASA-2014-0509.html
security.gentoo.org/glsa/201701-04
securityfocus.com/bid/71334
debian.org/security/2014/dsa-3083
nvd.nist.gov/vuln/detail/CVE-2014-9116
github.com/advisories/GHSA-mv99-5p2c-93vv
security-tracker.debian.org/tracker/CVE-2014-9116
bugs.mageia.org/show_bug.cgi?id=14707
suse.com/support/update/announcement/2015/suse-su-20150758-1
bugzilla.suse.com/868115
ubuntu.com/security/CVE-2014-9116
cve.org/CVERecord?id=CVE-2014-9116