Every CVESearch/Get API key

CVE-2014-9116

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the...

5.0 MediumFix available

CVE-2014-9116 is a medium vulnerability (CVSS 5.0) in Mutt, published March 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.69%, the 95th percentile. Fixed in mutt 1.5.23-2.

Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
9.69%EPSS, 95th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.5.23-2mutt +14 more

Description

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Exploit likelihood

9.69%Up 6.3 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
Debian:12
before 1.5.23-2
1.5.23-2
mutt
Debian:13
before 1.5.23-2
1.5.23-2
mutt
Debian:14
before 1.5.23-2
1.5.23-2
mutt
Debian:6.0
before 1.5.20-9+squeeze4, plus listed versions
1.5.20-9+squeeze11.5.20-9+squeeze21.5.20-9+squeeze3
1.5.20-9+squeeze4
mutt
Debian:7
before 1.5.21-6.2+deb7u3, plus listed versions
1.5.21-6.21.5.21-6.2+deb7u11.5.21-6.2+deb7u21.5.21-6.2+deb7u2~bpo60+1
1.5.21-6.2+deb7u3
mutt
Mageia:4
before 1.5.23-1.mga4
1.5.23-1.mga4
mutt
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 16 CVEs
before 1.10.1-55.3.1
1.10.1-55.3.1
mutt
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 16 CVEs
before 1.10.1-55.3.1
1.10.1-55.3.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 16 CVEs
before 1.10.1-55.3.1
1.10.1-55.3.1
mutt
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 16 CVEs
before 1.10.1-3.3.4
1.10.1-3.3.4
Show 5 moreShow less
Affected packages
PackageAffectedFixed
mutt
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 16 CVEs
before 1.10.1-55.6.1
1.10.1-55.6.1
mutt
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 16 CVEs
before 1.10.1-55.6.1
1.10.1-55.6.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 16 CVEs
before 1.10.1-55.6.1
1.10.1-55.6.1
mutt
Ubuntu:14.04:LTS
before 1.5.21-6.4ubuntu2.1, plus listed versions
1.5.21-6.4ubuntu11.5.21-6.4ubuntu2
1.5.21-6.4ubuntu2.1
mutt
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 1.6.2-3.1
1.6.2-3.1

What each source reports

NVD Score used5.0

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
CVE-2014-9116
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
CVE-2014-9116
Updated
2026-11-02
EUVDEUVD-2014-8942No score

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
EUVD-2014-8942
Updated
2026-11-03
GitHub AdvisoriesGHSA-mv99-5p2c-93vvNo score

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the...

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
GHSA-mv99-5p2c-93vv
Weakness
CWE-119
Updated
2026-11-02
OSVNo score

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
CVE-2014-9116
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9116No score

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
DEBIAN-CVE-2014-9116
Updated
2026-11-02
Show 8 moreShow less
OSVMGASA-2014-0509No score

Updated mutt packages fix CVE-2014-9116

Updated mutt packages fix security vulnerability:

A flaw was discovered in mutt. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition (CVE-2014-9116).

The mutt package has been updated to version 1.5.23 and patched to fix this issue.

Record
MGASA-2014-0509
Updated
2026-11-02
OSVopenSUSE-SU-2024:10198-1No score

mutt-1.6.2-3.1 on GA media

These are all security issues fixed in the mutt-1.6.2-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10198-1
Updated
2026-11-02
OSVSUSE-SU-2015:0758-1No score

Security update for mutt

The mailreader mutt was updated to fix a security issue in displaying mail headers, where a crafted e-mail could cause a heap overflow, which in turn might be used by attackers to crash mutt or potentially even execute code.

Security Issues references:

* CVE-2014-0467
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467>
Record
SUSE-SU-2015:0758-1
Updated
2026-11-02
OSVSUSE-SU-2018:2084-1No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • bsc#1101428: Mutt 1.10.1 security release update.
  • CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
  • CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes:

  • mutt reports as neomutt and incorrect version (bsc#1094717)
  • No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
  • mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
  • (neo)mutt displaying times in Zulu time (bsc#1061343)
  • mutt unconditionally segfaults when displaying a message (bsc#986534)
Record
SUSE-SU-2018:2084-1
Updated
2026-11-02
OSVSUSE-SU-2018:2085-1No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • bsc#1101428: Mutt 1.10.1 security release update.
  • CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
  • CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes:

  • mutt reports as neomutt and incorrect version (bsc#1094717)
Record
SUSE-SU-2018:2085-1
Updated
2026-11-02
OSVSUSE-SU-2019:1196-1No score

Security update for mutt

This update for mutt fixes the following issues:

Security issues fixed:

  • bsc#1101428: Mutt 1.10.1 security release update.
  • CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
  • CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
  • CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
  • CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
  • CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
  • CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
  • CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
  • CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
  • CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
  • CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
  • CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
  • CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
  • CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
  • CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
  • CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).

Bug fixes:

  • mutt reports as neomutt and incorrect version (bsc#1094717)
  • No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
  • mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
  • (neo)mutt displaying times in Zulu time (bsc#1061343)
  • mutt unconditionally segfaults when displaying a message (bsc#986534)
Record
SUSE-SU-2019:1196-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9116No score

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Record
UBUNTU-CVE-2014-9116
Updated
2026-11-02
OSVUSN-2440-1No score

mutt vulnerability

Jakub Wilk discovered that the write_one_header function in mutt did not properly handle newline characters at the beginning of a header. An attacker could specially craft an email to cause mutt to crash, resulting in a denial of service.

Record
USN-2440-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 59 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open