CVE-2021-32055

Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.

Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.

Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.

Out-of-bounds read in imap/util.c when an IMAP sequence set ends with a comma. (CVE-2021-32055) Overflow in uudecoder in Mutt allows read past end of input line (CVE-2022-1328)

This update for neomutt fixes the following issues:

neomutt was updated to 20220429:

• Bug Fixes
• Do not crash on an invalid use_threads/sort combination
• Fix: stuck browser cursor
• Resolve (move) the cursor after <edit-label>
• Index: fix menu size on new mail
• Don't overlimit LMDB mmap size
• OpenBSD y/n translation fix
• Generic: split out OP_EXIT binding
• Fix parsing of sendmail cmd
• Fix: crash with menu_move_off=no
• Newsrc: bugfix; nntp_user and nntp_pass ignored
• Menu: ensure config changes cause a repaint
• Mbox: fix sync duplicates
• Make sure the index redraws all that's needed
• Translations
• 100% Chinese (Simplified)
• 100% Czech
• 100% German
• 100% Hungarian
• 100% Lithuanian
• 100% Serbian
• 100% Turkish
• Docs
• add missing pattern modifier ~I for external_search_command
• Code
• menu: eliminate custom_redraw()
• modernise mixmaster
• Kill global and Propagate display attach status through State-

neomutt was updated to 20220415:

• Security
• Fix uudecode buffer overflow (CVE-2022-1328)
• Features
• Colours, colours, colours
• Bug Fixes
• Pager: fix pager_stop
• Merge colours with normal
• Color: disable mono command
• Fix forwarding text attachments when honor_disposition is set
• Pager: drop the nntp change-group bindings
• Use mailbox_check flags coherently, add IMMEDIATE flag
• Fix: tagging in attachment list
• Fix: misalignment of mini-index
• Make sure to update the menu size after a resort
• Translations
• 100% Hungarian
• Build
• Update acutest
• Code
• Unify pipe functions
• Index: notify if navigation fails
• Gui: set colour to be merged with normal
• Fix: leak in tls_check_one_certificate()
• Upstream
• Flush iconv() in mutt_convert_string()
• Fix integer overflow in mutt_convert_string()
• Fix uudecode cleanup on unexpected eof

update to 20220408:

• Compose multipart emails
• Fix screen mode after attempting decryption
• imap: increase max size of oauth2 token
• Fix autocrypt
• Unify Alias/Query workflow
• Fix colours
• Say which file exists when saving attachments
• Force SMTP authentication if smtp_user is set
• Fix selecting the right email after limiting
• Make sure we have enough memory for a new email
• Don't overwrite with zeroes after unlinking the file
• Fix crash when forwarding attachments
• Fix help reformatting on window resize
• Fix poll to use PollFdsCount and not PollFdsLen
• regex: range check arrays strictly
• Fix Coverity defects
• Fix out of bounds write with long log lines
• Apply fast_reply to 'to', 'cc', or 'bcc'
• Prevent warning on empty emails
• New default: set rfc2047_parameters = yes
• 100% German
• 100% Lithuanian
• 100% Serbian
• 100% Czech
• 100% Turkish
• 72% Hungarian
• Improve header cache explanation
• Improve description of some notmuch variables
• Explain how timezones and !s work inside %{}, %[] and %()
• Document config synonyms and deprecations
• Create lots of GitHub Actions
• Drop TravisCI
• Add automated Fuzzing tests
• Add automated ASAN tests
• Create Dockers for building Centos/Fedora
• Build fixes for Solaris 10
• New libraries: browser, enter, envelope
• New configure options: --fuzzing --debug-color --debug-queue
• Split Index/Pager GUIs/functions
• Add lots of function dispatchers
• Eliminate menu_loop()
• Refactor function opcodes
• Refactor cursor setting
• Unify Alias/Query functions
• Refactor Compose/Envelope functions
• Modernise the Colour handling
• Refactor the Attachment View
• Eliminate the global Context
• Upgrade mutt_get_field()
• Refactor the color quoted code
• Fix lots of memory leaks
• Refactor Index resolve code
• Refactor PatternList parsing
• Refactor Mailbox freeing
• Improve key mapping
• Factor out charset hooks
• Expose mutt_file_seek API
• Improve API of strto* wrappers
• imap QRESYNC fixes
• Allow an empty To: address prompt
• Fix argc==0 handling
• Don't queue IMAP close commands
• Fix IMAP UTF-7 for code points >= U+10000
• Don't include inactive messages in msgset generation …

These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the neomutt-20211029-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

It was discovered that Mutt incorrectly handled certain input. An attacker could possibly use this issue to cause a crash, or expose sensitive information. (CVE-2022-1328)

Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)

Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)

It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)

It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328)

It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)