{"id":"CVE-2014-0467","aliases":["DEBIAN-CVE-2014-0467","DSA-2874-1","EUVD-2014-0505","GHSA-qw3h-r7wr-mxvx","MGASA-2014-0141","RHSA-2014:0304","SUSE-SU-2015:0758-1","openSUSE-SU-2024:10198-1"],"status":"published","title":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of...","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04484,"percentile":0.91539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-03-12T00:00:00Z","modified":"2026-10-23T15:47:33Z","fixes":[{"ecosystem":"Debian:12","package":"mutt","fixed_in":["1.5.22-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mutt","fixed_in":["1.5.22-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mutt","fixed_in":["1.5.22-2"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"mutt","fixed_in":["1.5.20-9+squeeze3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mutt","fixed_in":["1.5.21-6.2+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"mutt","fixed_in":["1.5.21-10.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"mutt","fixed_in":["1.5.21-12.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mutt","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mutt-debuginfo","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mutt","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mutt-debuginfo","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mutt","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mutt-debuginfo","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mutt","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mutt-debuginfo","fixed_in":["5:1.5.20-4.20091214hg736b6a.el6_5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.22-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.22-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.22-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.20-9+squeeze3"}]}],"versions":["1.5.20-9+squeeze1","1.5.20-9+squeeze2"]},{"source":"osv","ecosystem":"Debian:7","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.21-6.2+deb7u2"}]}],"versions":["1.5.21-6.2","1.5.21-6.2+deb7u1","1.5.21-6.2+deb7u2~bpo60+1"]},{"source":"osv","ecosystem":"Mageia:3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.21-10.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.21-12.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:1.5.20-4.20091214hg736b6a.el6_5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-3.1"}]}],"bundled":2}],"products":[{"vendor":"mutt","product":"mutt"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2874","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2147-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0304.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/66165","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.mutt.org/doc/devel/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1029919","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-03/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-03/msg00085.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0467","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qw3h-r7wr-mxvx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0467","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0141.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13004","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0304.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0304","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1075860","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0304.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0467","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0467","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150758-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/868115","tags":["report"]},{"url":"https://bugzilla.suse.com/905481","tags":["report"]},{"url":"https://bugzilla.suse.com/907453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9116","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-0467","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","status":"published","published":"2014-03-14T15:00:00Z","modified":"2024-08-06T09:20:17.952Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0505","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","status":"published","published":"2014-03-14T15:00:00Z","modified":"2024-08-06T09:20:17Z","updated_at":"2026-11-03T01:57:21.099925Z"}],"ghsa":[{"id":"GHSA-qw3h-r7wr-mxvx","title":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of...","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","status":"published","published":"2022-05-14T02:09:21Z","modified":"2023-02-02T05:05:14Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:03.084435Z"}],"nvd":[{"id":"CVE-2014-0467","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","status":"published","published":"2014-03-14T15:55:05.637Z","modified":"2026-06-17T00:03:05.763Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"CVE-2014-0467","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","status":"published","published":"2014-03-14T15:55:05Z","modified":"2026-04-16T06:21:48.816837196Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0467","description":"Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.","status":"published","published":"2014-03-14T15:55:05.637Z","modified":"2026-10-23T15:47:33.688298959Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2874-1","title":"mutt - security update","status":"published","published":"2014-03-12T00:00:00Z","modified":"2026-03-09T01:19:47.741821Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0141","title":"Updated mutt package fixes security vulnerability","description":"A heap-based buffer overflow flaw was found in the way mutt processed\ncertain email headers. A remote attacker could use this flaw to send an\nemail with specially crafted headers that, when processed, could cause\nmutt to crash or, potentially, execute arbitrary code with the permissions\nof the user running mutt (CVE-2014-0467).\n","status":"published","published":"2014-03-31T19:30:41Z","modified":"2026-04-16T06:22:24.993347693Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10198-1","title":"mutt-1.6.2-3.1 on GA media","description":"These are all security issues fixed in the mutt-1.6.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:21.396343Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:0304","title":"Red Hat Security Advisory: mutt security update","status":"published","published":"2024-09-15T21:30:34Z","modified":"2026-06-26T10:23:35Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2015:0758-1","title":"Security update for mutt","description":"\nThe mailreader mutt was updated to fix a security issue in displaying mail \nheaders, where a crafted e-mail could cause a heap overflow, which in turn \nmight be used by attackers to crash mutt or potentially even execute code.\n\nSecurity Issues references:\n\n    * CVE-2014-0467\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467\u003e\n\n","status":"published","published":"2014-03-17T16:14:56Z","modified":"2026-02-04T04:36:18.715961Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}