{"id":"CVE-2014-9116","aliases":["DEBIAN-CVE-2014-9116","DLA-100-1","DSA-3083-1","EUVD-2014-8942","GHSA-mv99-5p2c-93vv","MGASA-2014-0509","SUSE-SU-2015:0758-1","SUSE-SU-2018:2084-1","SUSE-SU-2018:2085-1","SUSE-SU-2019:1196-1","UBUNTU-CVE-2014-9116","USN-2440-1","openSUSE-SU-2024:10198-1"],"status":"published","title":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the...","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.09694,"percentile":0.95542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-03-17T16:14:56Z","modified":"2026-10-23T15:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"mutt","fixed_in":["1.5.23-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mutt","fixed_in":["1.5.23-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mutt","fixed_in":["1.5.23-2"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"mutt","fixed_in":["1.5.20-9+squeeze4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mutt","fixed_in":["1.5.21-6.2+deb7u3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"mutt","fixed_in":["1.5.23-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mutt","fixed_in":["1.5.21-6.4ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.23-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.23-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.23-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.20-9+squeeze4"}]}],"versions":["1.5.20-9+squeeze1","1.5.20-9+squeeze2","1.5.20-9+squeeze3"]},{"source":"osv","ecosystem":"Debian:7","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.21-6.2+deb7u3"}]}],"versions":["1.5.21-6.2","1.5.21-6.2+deb7u1","1.5.21-6.2+deb7u2","1.5.21-6.2+deb7u2~bpo60+1"]},{"source":"osv","ecosystem":"Mageia:4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.23-1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.3.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.3.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.3.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.3.4"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.6.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.6.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.6.1"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.21-6.4ubuntu2.1"}]}],"versions":["1.5.21-6.4ubuntu1","1.5.21-6.4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.21-6.4ubuntu2.1"}]}],"versions":["1.5.21-6.4ubuntu1","1.5.21-6.4ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-3.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mageia","product":"mageia"},{"vendor":"mutt","product":"mutt"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"suse_linux_enterprise_server"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168463","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","evidence","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","evidence","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1031266","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://dev.mutt.org/trac/ticket/3716","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/27/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","advisory","article","evidence"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:078","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link","advisory"]},{"url":"http://advisories.mageia.org/MGASA-2014-0509.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/27/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securityfocus.com/bid/71334","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3083","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:245","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9116"},{"url":"https://github.com/advisories/GHSA-mv99-5p2c-93vv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9116","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0509.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14707","tags":["report"]},{"url":"https://www.debian.org/security/2014/dsa-3083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150758-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/868115","tags":["report"]},{"url":"https://bugzilla.suse.com/905481","tags":["report"]},{"url":"https://bugzilla.suse.com/907453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9116","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182084-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1061343","tags":["report"]},{"url":"https://bugzilla.suse.com/1094717","tags":["report"]},{"url":"https://bugzilla.suse.com/1101428","tags":["report"]},{"url":"https://bugzilla.suse.com/1101566","tags":["report"]},{"url":"https://bugzilla.suse.com/1101567","tags":["report"]},{"url":"https://bugzilla.suse.com/1101568","tags":["report"]},{"url":"https://bugzilla.suse.com/1101569","tags":["report"]},{"url":"https://bugzilla.suse.com/1101570","tags":["report"]},{"url":"https://bugzilla.suse.com/1101571","tags":["report"]},{"url":"https://bugzilla.suse.com/1101573","tags":["report"]},{"url":"https://bugzilla.suse.com/1101576","tags":["report"]},{"url":"https://bugzilla.suse.com/1101577","tags":["report"]},{"url":"https://bugzilla.suse.com/1101578","tags":["report"]},{"url":"https://bugzilla.suse.com/1101581","tags":["report"]},{"url":"https://bugzilla.suse.com/1101582","tags":["report"]},{"url":"https://bugzilla.suse.com/1101583","tags":["report"]},{"url":"https://bugzilla.suse.com/1101588","tags":["report"]},{"url":"https://bugzilla.suse.com/1101589","tags":["report"]},{"url":"https://bugzilla.suse.com/980830","tags":["report"]},{"url":"https://bugzilla.suse.com/982129","tags":["report"]},{"url":"https://bugzilla.suse.com/986534","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14363","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182085-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191196-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168463#c4","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2440-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9116","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-9116","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2014-12-02T16:00:00Z","modified":"2024-08-06T13:33:13.432Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-8942","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2014-12-02T16:00:00Z","modified":"2024-08-06T13:33:13Z","updated_at":"2026-11-03T01:56:50.141542Z"}],"ghsa":[{"id":"GHSA-mv99-5p2c-93vv","title":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the...","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2022-05-14T02:04:22Z","modified":"2023-02-02T05:05:20Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:04.117158Z"}],"nvd":[{"id":"CVE-2014-9116","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2014-12-02T16:59:08.15Z","modified":"2026-06-17T00:17:47.27Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-9116","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2014-12-02T16:59:08Z","modified":"2026-04-16T06:19:28.714351306Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9116","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2014-12-02T16:59:08.15Z","modified":"2026-10-23T15:47:36.276823744Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-100-1","title":"mutt - security update","status":"published","published":"2014-12-05T00:00:00Z","modified":"2026-03-09T01:01:51.552951Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-3083-1","title":"mutt - security update","status":"published","published":"2014-11-30T00:00:00Z","modified":"2026-03-09T01:18:10.421374Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0509","title":"Updated mutt packages fix CVE-2014-9116","description":"Updated mutt packages fix security vulnerability:\n\nA flaw was discovered in mutt. A specially crafted mail header could cause\nmutt to crash, leading to a denial of service condition (CVE-2014-9116).\n\nThe mutt package has been updated to version 1.5.23 and patched to fix this\nissue.\n","status":"published","published":"2014-12-05T15:54:13Z","modified":"2026-04-16T06:25:22.817976775Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10198-1","title":"mutt-1.6.2-3.1 on GA media","description":"These are all security issues fixed in the mutt-1.6.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:21.396343Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0758-1","title":"Security update for mutt","description":"\nThe mailreader mutt was updated to fix a security issue in displaying mail \nheaders, where a crafted e-mail could cause a heap overflow, which in turn \nmight be used by attackers to crash mutt or potentially even execute code.\n\nSecurity Issues references:\n\n    * CVE-2014-0467\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467\u003e\n\n","status":"published","published":"2014-03-17T16:14:56Z","modified":"2026-02-04T04:36:18.715961Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2018:2084-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\nSecurity issues fixed:\n\n- bsc#1101428: Mutt 1.10.1 security release update.\n- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).\n- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).\n- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).\n- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).\n- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).\n- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).\n- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).\n- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).\n- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).\n- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).\n- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).\n- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).\n- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).\n- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).\n- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).\n\nBug fixes:\n\n- mutt reports as neomutt and incorrect version (bsc#1094717)\n- No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)\n- mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)\n- (neo)mutt displaying times in Zulu time (bsc#1061343)\n- mutt unconditionally segfaults when displaying a message (bsc#986534)\n","status":"published","published":"2018-07-27T10:45:47Z","modified":"2026-02-04T04:22:05.703181Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2085-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\nSecurity issues fixed:\n\n- bsc#1101428: Mutt 1.10.1 security release update.\n- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).\n- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).\n- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).\n- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).\n- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).\n- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).\n- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).\n- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).\n- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).\n- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).\n- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).\n- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).\n- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).\n- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).\n- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).\n\nBug fixes:\n\n- mutt reports as neomutt and incorrect version (bsc#1094717)\n","status":"published","published":"2018-07-27T10:47:58Z","modified":"2026-02-04T02:48:11.09876Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2019:1196-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\nSecurity issues fixed:\n\n- bsc#1101428: Mutt 1.10.1 security release update.\n- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).\n- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).\n- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).\n- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).\n- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).\n- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).\n- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).\n- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).\n- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).\n- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).\n- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).\n- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).\n- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).\n- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).\n- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).\n\nBug fixes:\n\n- mutt reports as neomutt and incorrect version (bsc#1094717)\n- No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)\n- mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)\n- (neo)mutt displaying times in Zulu time (bsc#1061343)\n- mutt unconditionally segfaults when displaying a message (bsc#986534)\n","status":"published","published":"2019-05-09T06:14:33Z","modified":"2026-02-04T03:08:14.445391Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"UBUNTU-CVE-2014-9116","description":"The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.","status":"published","published":"2014-12-02T00:00:00Z","modified":"2026-02-04T02:23:34.579194Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2440-1","title":"mutt vulnerability","description":"Jakub Wilk discovered that the write_one_header function in mutt\ndid not properly handle newline characters at the beginning of a\nheader. An attacker could specially craft an email to cause mutt to\ncrash, resulting in a denial of service.\n","status":"published","published":"2014-12-11T20:01:29Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}