{"id":"CVE-2020-14154","aliases":["DEBIAN-CVE-2020-14154","EUVD-2020-6311","GHSA-v3gg-5crq-w4vj","OESA-2021-1399","SUSE-SU-2020:14414-1","SUSE-SU-2020:1771-1","SUSE-SU-2020:1794-1","UBUNTU-CVE-2020-14154","USN-4401-1","openSUSE-SU-2020:0903-1","openSUSE-SU-2020:0915-1","openSUSE-SU-2020:2127-1","openSUSE-SU-2020:2157-1","openSUSE-SU-2020:2158-1","openSUSE-SU-2024:11079-1","openSUSE-SU-2024:13279-1"],"status":"published","title":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt...","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01088,"percentile":0.65601,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-06-15T16:51:17Z","modified":"2026-10-26T12:01:28Z","fixes":[{"ecosystem":"Debian:12","package":"mutt","fixed_in":["1.14.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mutt","fixed_in":["1.14.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mutt","fixed_in":["1.14.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"neomutt","fixed_in":["20200619+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"neomutt","fixed_in":["20200619+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"neomutt","fixed_in":["20200619+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"mutt","fixed_in":["1.10.1-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"mutt","fixed_in":["1.10.1-9.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"mutt","fixed_in":["1.5.24-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"mutt","fixed_in":["1.9.4-3ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mutt","fixed_in":["1.13.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mutt","fixed_in":["2.2.12-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200619+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200619+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200619+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-9.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.17-42.51.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.17-42.51.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.24-1ubuntu0.3"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu0.2"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1ubuntu0.1"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.24-1ubuntu0.3"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu0.2"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1ubuntu0.1"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-lp151.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-lp152.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201120-lp152.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201120-lp152.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201120-bp151.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201120-bp152.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210205-3.3"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-2.1"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"mutt","product":"mutt"}],"references":[{"url":"http://www.mutt.org","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory","report"]},{"url":"http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200608/000022.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://bugs.gentoo.org/728300","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://usn.ubuntu.com/4401-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202007-57","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14154","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v3gg-5crq-w4vj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14154","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1399","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014414-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172906","tags":["report"]},{"url":"https://bugzilla.suse.com/1172935","tags":["report"]},{"url":"https://bugzilla.suse.com/1173197","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14954","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201771-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201794-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-14154","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4401-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14093","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VMKWM3Q7YV5QZYXLMV7ZD4C7U3TIC47V/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YBIPCQJIPE7SK6FTWEHP7GQVKLFCWKDR/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RDM45YGFPRPSTCQV554CQT4P74X6HNGI/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179035","tags":["report"]},{"url":"https://bugzilla.suse.com/1179113","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28896","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SO2YEN5NDIBWU3W774SS3UQQJQHS3Y2L/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LP3RDP5YFHOILA5LLZD7YQXIDYSTUJ2A/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14363","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14154","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2020-06-15T16:51:17Z","modified":"2024-08-04T12:39:36.045Z","updated_at":"2026-11-02T14:35:46.873079Z"}],"euvd":[{"id":"EUVD-2020-6311","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2020-06-15T16:51:17Z","modified":"2024-08-04T12:39:36Z","updated_at":"2026-11-03T03:07:35.099081Z"}],"ghsa":[{"id":"GHSA-v3gg-5crq-w4vj","title":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt...","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2022-05-24T17:20:33Z","modified":"2023-03-01T18:31:01Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:54:15.073729Z"}],"nvd":[{"id":"CVE-2020-14154","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2020-06-15T17:15:10.717Z","modified":"2026-06-17T02:54:18.26Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"CVE-2020-14154","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2020-06-15T17:15:10.717Z","modified":"2026-10-24T10:30:31.37774306Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14154","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2020-06-15T17:15:10.717Z","modified":"2026-10-26T12:01:28.626575317Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"OESA-2021-1399","title":"mutt security update","description":"Mutt is a small but very powerful text-based mail client for Unix operating systems.\r\n\r\nSecurity Fix(es):\r\n\r\nMutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.(CVE-2020-14154)","status":"published","published":"2021-10-19T11:04:40Z","modified":"2026-08-18T01:16:11.326654819Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-14154","description":"Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.","status":"published","published":"2020-06-15T17:15:00Z","modified":"2026-02-04T02:16:12.034735Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"openSUSE-SU-2020:0903-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was \n  affecting IMAP, SMTP, and POP3 (bsc#1173197).\n- CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).\n- CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was \n  proceeding with a connection (bsc#1172906, bsc#1172935). \n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-29T10:17:03Z","modified":"2026-02-04T03:00:28.230861Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0915-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was \n  affecting IMAP, SMTP, and POP3 (bsc#1173197).\n- CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).\n- CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was \n  proceeding with a connection (bsc#1172906, bsc#1172935). \n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-29T18:20:43Z","modified":"2025-05-07T18:11:30.054034Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:2127-1","title":"Security update for neomutt","description":"This update for neomutt fixes the following issues:\n\nUpdate neomutt to 20201120. Address boo#1179035, CVE-2020-28896.\n\n  * Security\n    - imap: close connection on all failures\n  * Features\n    - alias: add function to Alias/Query dialogs\n    - config: add validators for {imap,smtp,pop}_authenticators\n    - config: warn when signature file is missing or not readable\n    - smtp: support for native SMTP LOGIN auth mech\n    - notmuch: show originating folder in index\n  * Bug Fixes\n    - sidebar: prevent the divider colour bleeding out\n    - sidebar: fix \u003csidebar-{next,prev}-new\u003e\n    - notmuch: fix query for current email\n    - restore shutdown-hook functionality\n    - crash in reply-to\n    - user-after-free in folder-hook\n    - fix some leaks\n    - fix application of limits to modified mailboxes\n    - write Date header when postponing\n  * Translations\n    - 100% Lithuanian\n    - 100% Czech\n    - 70% Turkish\n  * Docs\n    - Document that $sort_alias affects the query menu\n  * Build\n    - improve ASAN flags\n    - add SASL and S/MIME to --everything\n    - fix contrib (un)install\n  * Code\n    - my_hdr compose screen notifications\n    - add contracts to the MXAPI\n    - maildir refactoring\n    - further reduce the use of global variables\n  * Upstream\n    - Add $count_alternatives to count attachments inside alternatives\n- Changes from 20200925\n  * Features\n    - Compose: display user-defined headers\n    - Address Book / Query: live sorting\n    - Address Book / Query: patterns for searching\n    - Config: Add '+=' and '-=' operators for String Lists\n    - Config: Add '+=' operator for Strings\n    - Allow postfix query ':setenv NAME?' for env vars\n  * Bug Fixes\n    - Fix crash when searching with invalid regexes\n    - Compose: Prevent infinite loop of send2-hooks\n    - Fix sidebar on new/removed mailboxes\n    - Restore indentation for named mailboxes\n    - Prevent half-parsing an alias\n    - Remove folder creation prompt for POP path\n    - Show error if $message_cachedir doesn't point to a valid directory\n    - Fix tracking LastDir in case of IMAP paths with Unicode characters\n    - Make sure all mail gets applied the index limit\n    - Add warnings to -Q query CLI option\n    - Fix index tracking functionality\n  * Changed Config\n    - Add $compose_show_user_headers (yes)\n  * Translations\n    - 100% Czech\n    - 100% Lithuanian\n    - Split up usage strings\n  * Build\n    - Run shellcheck on hcachever.sh\n    - Add the Address Sanitizer\n    - Move compose files to lib under compose/\n    - Move address config into libaddress\n    - Update to latest acutest - fixes a memory leak in the unit tests\n  * Code\n    - Implement ARRAY API\n    - Deglobalised the Config Sort functions\n    - Refactor the Sidebar to be Event-Driven\n    - Refactor the Color Event\n    - Refactor the Commands list\n    - Make ctx_update_tables private\n    - Reduce the scope/deps of some Validator functions\n    - Use the Email's IMAP UID instead of an increasing number as index\n    - debug: log window focus\n- Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch.\n  No longer needed.\n\n- Update to 20200821:\n  * Bug Fixes\n    - fix maildir flag generation\n    - fix query notmuch if file is missing\n    - notmuch: don't abort sync on error\n    - fix type checking for send config variables\n  * Changed Config\n    - $sidebar_format - Use %D rather than %B for named mailboxes\n  * Translations\n    - 96% Lithuanian\n    - 90% Polish\n- fix(sidebar): abbreviate/shorten what user sees\n\n- Fix sidebar mailbox name display problem. \n\n- Update to 20200814:\n  * Notes\n    - Add one-liner docs to config items\n      See: neomutt -O -Q smart_wrap\n    - Remove the built-in editor\n      A large unused and unusable feature\n  * Security\n    - Add mitigation against DoS from thousands of parts\n      boo#1179113\n  * Features\n    - Allow index-style searching in postpone menu\n    - Open NeoMutt using a mailbox name\n    - Add cd command to change the current working directory\n    - Add tab-completion menu for patterns\n    - Allow renaming existing mailboxes\n    - Check for missing attachments in alternative parts\n    - Add one-liner docs to config items\n  * Bug Fixes\n    - Fix logic in checking an empty From address\n    - Fix Imap crash in cmd_parse_expunge()\n    - Fix setting attributes with S-Lang\n    - Fix: redrawing of $pager_index_lines\n    - Fix progress percentage for syncing large mboxes\n    - Fix sidebar drawing in presence of indentation + named mailboxes\n    - Fix retrieval of drafts when 'postponed' is not in the mailboxes list\n    - Do not add comments to address group terminators\n    - Fix alias sorting for degenerate addresses\n    - Fix attaching emails\n    - Create directories for nonexistent file hcache case\n    - Avoid creating mailboxes for failed subscribes\n    - Fix crash if rejecting cert\n  * Changed Config\n    - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed\n    - Change default of $crypt_protected_headers_subject to '...'\n    - Add default keybindings to history-up/down\n  * Translations\n    - 100% Czech\n    - 100% Spanish\n  * Build\n    - Allow building against Lua 5.4\n    - Fix when sqlite3.h is missing\n  * Docs\n    - Add a brief section on stty to the manual\n    - Update section 'Terminal Keybindings' in the manual\n    - Clarify PGP Pseudo-header S\u003cid\u003e duration\n  * Code\n    - Clean up String API\n    - Make the Sidebar more independent\n    - De-centralise the Config Variables\n    - Refactor dialogs\n    - Refactor: Help Bar generation\n    - Make more APIs Context-free\n    - Adjust the edata use in Maildir and Notmuch\n    - Window refactoring\n    - Convert libsend to use Config functions\n    - Refactor notifications to reduce noise\n    - Convert Keymaps to use STAILQ\n    - Track currently selected email by msgid\n    - Config: no backing global variable\n    - Add events for key binding\n  * Upstream\n    - Fix imap postponed mailbox use-after-free error\n    - Speed up thread sort when many long threads exist\n    - Fix ~v tagging when switching to non-threaded sorting\n    - Add message/global to the list of known 'message' types\n    - Print progress meter when copying/saving tagged messages\n    - Remove ansi formatting from autoview generated quoted replies\n    - Change postpone mode to write Date header too\n    - Unstuff format=flowed\n\n- Update to 20200626:\n  * Bug Fixes\n    - Avoid opening the same hcache file twice\n    - Re-open Mailbox after folder-hook\n    - Fix the matching of the spoolfile Mailbox\n    - Fix link-thread to link all tagged emails\n  * Changed Config\n    - Add $tunnel_is_secure config, defaulting to true\n  * Upstream\n    - Don't check IMAP PREAUTH encryption if $tunnel is in use\n    - Add recommendation to use $ssl_force_tls\n- Changes from 20200501:\n  * Security\n    - Abort GnuTLS certificate check if a cert in the chain is rejected\n      CVE-2020-14154 boo#1172906\n    - TLS: clear data after a starttls acknowledgement\n      CVE-2020-14954 boo#1173197\n    - Prevent possible IMAP MITM via PREAUTH response\n      CVE-2020-14093 boo#1172935\n  * Features\n    - add config operations +=/-= for number,long\n    - Address book has a comment field\n    - Query menu has a comment field\n  * Contrib\n     sample.neomuttrc-starter: Do not echo prompted password\n  * Bug Fixes\n    - make 'news://' and 'nntp://' schemes interchangeable\n    - Fix CRLF to LF conversion in base64 decoding\n    - Double comma in query\n    - compose: fix redraw after history\n    - Crash inside empty query menu\n    - mmdf: fix creating new mailbox\n    - mh: fix creating new mailbox\n    - mbox: error out when an mbox/mmdf is a pipe\n    - Fix list-reply by correct parsing of List-Post headers\n    - Decode references according to RFC2047\n    - fix tagged message count\n    - hcache: fix keylen not being considered when building the full key\n    - sidebar: fix path comparison\n    - Don't mess with the original pattern when running IMAP searches\n    - Handle IMAP 'NO' resps by issuing a msg instead of failing badly\n    - imap: use the connection delimiter if provided\n    - Memory leaks\n  * Changed Config\n    - $alias_format default changed to include %c comment\n    - $query_format default changed to include %e extra info\n  * Translations\n    - 100% Lithuanian\n    - 84% French\n    - Log the translation in use\n  * Docs\n    - Add missing commands unbind, unmacro to man pages\n  * Build\n    - Check size of long using LONG_MAX instead of __WORDSIZE\n    - Allow ./configure to not record cflags\n    - fix out-of-tree build\n    - Avoid locating gdbm symbols in qdbm library\n  * Code\n    - Refactor unsafe TAILQ returns\n    - add window notifications\n    - flip negative ifs\n    - Update to latest acutest.h\n    - test: add store tests\n    - test: add compression tests\n    - graphviz: email\n    - make more opcode info available\n    - refactor: main_change_folder()\n    - refactor: mutt_mailbox_next()\n    - refactor: generate_body()\n    - compress: add {min,max}_level to ComprOps\n    - emphasise empty loops: '// do nothing'\n    - prex: convert is_from() to use regex\n    - Refactor IMAP's search routines\n\n- Update to 20200501:\n  * Bug Fixes\n    - Make sure buffers are initialized on error\n    - fix(sidebar): use abbreviated path if possible\n  * Translations\n    - 100% Lithuanian\n  * Docs\n    - make header cache config more explicit\n- Changes from 20200424:\n  * Bug Fixes\n    - Fix history corruption\n    - Handle pretty much anything in a URL query part\n    - Correctly parse escaped characters in header phrases\n    - Fix crash reading received header\n    - Fix sidebar indentation\n    - Avoid crashing on failure to parse an IMAP mailbox\n    - Maildir: handle deleted emails correctly\n    - Ensure OP_NULL is always first\n  * Translations\n    - 100% Czech\n  * Build\n    - cirrus: enable pcre2, make pkgconf a special case\n    - Fix finding pcre2 w/o pkgconf\n    - build: tdb.h needs size_t, bring it in with stddef.h\n- Changes from 20200417:\n  * Features\n    - Fluid layout for Compose Screen, see: vimeo.com/407231157\n    - Trivial Database (TDB) header cache backend\n    - RocksDB header cache backend\n    - Add \u003csidebar-first\u003e and \u003csidebar-last\u003e functions\n  * Bug Fixes\n    - add error for CLI empty emails\n    - Allow spaces and square brackets in paths\n    - browser: fix hidden mailboxes\n    - fix initial email display\n    - notmuch: fix time window search.\n    - fix resize bugs\n    - notmuch: fix entire-thread: update current email pointer\n    - sidebar: support indenting and shortening of names\n    - Handle variables inside backticks in sidebar_whitelist\n    - browser: fix mask regex error reporting\n  * Translations\n    - 100% Lithuanian\n    - 99% Chinese (simplified)\n  * Build\n    - Use regexes for common parsing tasks: urls, dates\n    - Add configure option --pcre2 -- Enable PCRE2 regular expressions\n    - Add configure option --tdb -- Use TDB for the header cache\n    - Add configure option --rocksdb -- Use RocksDB for the header cache\n    - Create libstore (key/value backends)\n    - Update to latest autosetup\n    - Update to latest acutest.h\n    - Rename doc/ directory to docs/\n    - make: fix location of .Po dependency files\n    - Change libcompress to be more universal\n    - Fix test fails on х32\n    - fix uidvalidity to unsigned 32-bit int\n  * Code\n    - Increase test coverage\n    - Fix memory leaks\n    - Fix null checks\n  * Upstream\n    - Buffer refactoring\n    - Fix use-after-free in mutt_str_replace()\n    - Clarify PGP Pseudo-header S\u003cid\u003e duration\n    - Try to respect MUTT_QUIET for IMAP contexts too\n    - Limit recurse depth when parsing mime messages\n\n- Update to 20200320:\n  * Bug Fixes\n    - Fix COLUMNS env var\n    - Fix sync after delete\n    - Fix crash in notmuch\n    - Fix sidebar indent\n    - Fix emptying trash\n    - Fix command line sending\n    - Fix reading large address lists\n    - Resolve symlinks only when necessary\n  * Translations\n    - lithuania 100% Lithuanian\n    - es 96% Spanish\n  * Docs\n    - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output\n    - Fix case of GPGME and SQLite\n  * Build\n    - Create libcompress (lz4, zlib, zstd)\n    - Create libhistory\n    - Create libbcache\n    - Move zstrm to libconn\n  * Code\n    - Add more test coverage\n    - Rename magic to type\n    - Use mutt_file_fopen() on config variables\n    - Change commands to use intptr_t for data\n\n- Update to 20200313:\n  * Window layout\n    - Sidebar is only visible when it's usable.\n  * Features\n    - UI: add number of old messages to sidebar_format\n    - UI: support ISO 8601 calendar date\n    - UI: fix commands that don’t need to have a non-empty mailbox\n      to be valid\n    - PGP: inform about successful decryption of inline PGP\n      messages\n    - PGP: try to infer the signing key from the From address\n    - PGP: enable GPGMe by default\n    - Notmuch: use query as name for vfolder-from-query\n    - IMAP: add network traffic compression\n      (COMPRESS=DEFLATE, RFC4978)\n    - Header cache: add support for generic header cache\n      compression\n  * Bug Fixes\n    - Fix uncollapse_jump\n    - Only try to perform entire-thread on maildir/mh mailboxes\n    - Fix crash in pager\n    - Avoid logging single new lines at the end of header fields\n    - Fix listing mailboxes\n    - Do not recurse a non-threaded message\n    - Fix initial window order\n    - Fix leaks on IMAP error paths\n    - Notmuch: compose(attach-message): support notmuch backend\n    - Fix IMAP flag comparison code\n    - Fix $move for IMAP mailboxes\n    - Maildir: maildir_mbox_check_stats should only update mailbox\n      stats if requested\n    - Fix unmailboxes for virtual mailboxes\n    - Maildir: sanitize filename before hashing\n    - OAuth: if 'login' name isn't available use 'user'\n    - Add error message on failed encryption\n    - Fix a bunch of crashes\n    - Force C locale for email date\n    - Abort if run without a terminal\n  * Changed Config\n    - $crypt_use_gpgme - Now defaults to 'yes' (enabled)\n    - $abort_backspace - Hitting backspace against an empty prompt\n      aborts the prompt\n    - $abort_key - String representation of key to abort prompts\n    - $arrow_string - Use an custom string for arrow_cursor\n    - $crypt_opportunistic_encrypt_strong_keys - Enable encryption\n      only when strong a key is available\n    - $header_cache_compress_dictionary - Filepath to dictionary\n      for zstd compression\n    - $header_cache_compress_level - Level of compression for\n      method\n    - $header_cache_compress_method - Enable generic hcache\n      database compression\n    - $imap_deflate - Compress network traffic\n    - $smtp_user - Username for the SMTP server\n  * Translations\n    - 100% Lithuanian\n    - 81% Spanish\n    - 78% Russian\n  * Build\n    - Add libdebug\n    - Rename public headers to lib.h\n    - Create libcompress for compressed folders code\n  * Code\n    - Refactor Windows and Dialogs\n    - Lots of code tidying\n    - Refactor: mutt_addrlist_{search,write}\n    - Lots of improvements to the Config code\n    - Use Buffers more pervasively\n    - Unify API function naming\n    - Rename library shared headers\n    - Refactor libconn gui dependencies\n    - Refactor: init.[ch]\n    - Refactor config to use subsets\n    - Config: add path type\n    - Remove backend deps from the connection code\n  * Upstream\n    - Allow ~b ~B ~h patterns in send2-hook\n    - Rename smime oppenc mode parameter to get_keys_by_addr()\n    - Add $crypt_opportunistic_encrypt_strong_keys config var\n    - Fix crash when polling a closed ssl connection\n    - Turn off auto-clear outside of autocrypt initialization\n    - Add protected-headers='v1' to Content-Type when protecting\n      headers\n    - Fix segv in IMAP postponed menu caused by reopen_allow\n    - Adding ISO 8601 calendar date\n    - Fix $fcc_attach to not prompt in batch mode\n    - Convert remaining mutt_encode_path() call to use struct\n      Buffer\n    - Fix rendering of replacement_char when Charset_is_utf8\n    - Update to latest acutest.h\n\n- Update to 20191207:\n  * Features:\n    - compose: draw status bar with highlights\n  * Bug Fixes:\n    - crash opening notmuch mailbox\n    - crash in mutt_autocrypt_ui_recommendation\n    - Avoid negative allocation\n    - Mbox new mail\n    - Setting of DT_MAILBOX type variables from Lua\n    - imap: empty cmdbuf before connecting\n    - imap: select the mailbox on reconnect\n    - compose: fix attach message\n  * Build:\n    - make files conditional\n  * Code:\n    - enum-ify log levels\n    - fix function prototypes\n    - refactor virtual email lookups\n    - factor out global Context\n- Changes from 20191129:\n  * Features:\n    - Add raw mailsize expando (%cr)\n  * Bug Fixes:\n    - Avoid double question marks in bounce confirmation msg\n    - Fix bounce confirmation\n    - fix new-mail flags and behaviour\n    - fix: browser \u003cdescend-directory\u003e\n    - fix ssl crash\n    - fix move to trash\n    - fix flickering\n    - Do not check hidden mailboxes for new mail\n    - Fix new_mail_command notifications\n    - fix crash in examine_mailboxes()\n    - fix crash in mutt_sort_threads()\n    - fix: crash after sending\n    - Fix crash in tunnel's conn_close\n    - fix fcc for deep dirs\n    - imap: fix crash when new mail arrives\n    - fix colour 'quoted9'\n    - quieten messages on exit\n    - fix: crash after failed mbox_check\n    - browser: default to a file/dir view when attaching a file\n  * Changed Config:\n    - Change $write_bcc to default off\n  * Docs:\n    - Add a bit more documentation about sending\n    - Clarify $write_bcc documentation.\n    - Update documentation for raw size expando\n    - docbook: set generate.consistent.ids to make generated html\n      reproducible\n  * Build:\n    - fix build/tests for 32-bit arches\n    - tests: fix test that would fail soon\n    - tests: fix context for failing idna tests\n\n- Update to 20191111:\n  Bug fixes:\n  * browser: fix directory view\n  * fix crash in mutt_extract_token()\n  * force a screen refresh\n  * fix crash sending message from command line\n  * notmuch: use nm_default_uri if no mailbox data\n  * fix forward attachments\n  * fix: vfprintf undefined behaviour in body_handler\n  * Fix relative symlink resolution\n  * fix: trash to non-existent file/dir\n  * fix re-opening of mbox Mailboxes\n  * close logging as late as possible\n  * log unknown mailboxes\n  * fix crash in command line postpone\n  * fix memory leaks\n  * fix icommand parsing\n  * fix new mail interaction with mail_check_recent\n","status":"published","published":"2020-11-30T19:22:48Z","modified":"2026-02-04T02:42:32.383087Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2157-1","title":"Security update for neomutt","description":"This update for neomutt fixes the following issues:\n\nUpdate neomutt to 20201120. Address boo#1179035, CVE-2020-28896.\n\n  * Security\n    - imap: close connection on all failures\n  * Features\n    - alias: add function to Alias/Query dialogs\n    - config: add validators for {imap,smtp,pop}_authenticators\n    - config: warn when signature file is missing or not readable\n    - smtp: support for native SMTP LOGIN auth mech\n    - notmuch: show originating folder in index\n  * Bug Fixes\n    - sidebar: prevent the divider colour bleeding out\n    - sidebar: fix \u003csidebar-{next,prev}-new\u003e\n    - notmuch: fix query for current email\n    - restore shutdown-hook functionality\n    - crash in reply-to\n    - user-after-free in folder-hook\n    - fix some leaks\n    - fix application of limits to modified mailboxes\n    - write Date header when postponing\n  * Translations\n    - 100% Lithuanian\n    - 100% Czech\n    - 70% Turkish\n  * Docs\n    - Document that $sort_alias affects the query menu\n  * Build\n    - improve ASAN flags\n    - add SASL and S/MIME to --everything\n    - fix contrib (un)install\n  * Code\n    - my_hdr compose screen notifications\n    - add contracts to the MXAPI\n    - maildir refactoring\n    - further reduce the use of global variables\n  * Upstream\n    - Add $count_alternatives to count attachments inside alternatives\n- Changes from 20200925\n  * Features\n    - Compose: display user-defined headers\n    - Address Book / Query: live sorting\n    - Address Book / Query: patterns for searching\n    - Config: Add '+=' and '-=' operators for String Lists\n    - Config: Add '+=' operator for Strings\n    - Allow postfix query ':setenv NAME?' for env vars\n  * Bug Fixes\n    - Fix crash when searching with invalid regexes\n    - Compose: Prevent infinite loop of send2-hooks\n    - Fix sidebar on new/removed mailboxes\n    - Restore indentation for named mailboxes\n    - Prevent half-parsing an alias\n    - Remove folder creation prompt for POP path\n    - Show error if $message_cachedir doesn't point to a valid directory\n    - Fix tracking LastDir in case of IMAP paths with Unicode characters\n    - Make sure all mail gets applied the index limit\n    - Add warnings to -Q query CLI option\n    - Fix index tracking functionality\n  * Changed Config\n    - Add $compose_show_user_headers (yes)\n  * Translations\n    - 100% Czech\n    - 100% Lithuanian\n    - Split up usage strings\n  * Build\n    - Run shellcheck on hcachever.sh\n    - Add the Address Sanitizer\n    - Move compose files to lib under compose/\n    - Move address config into libaddress\n    - Update to latest acutest - fixes a memory leak in the unit tests\n  * Code\n    - Implement ARRAY API\n    - Deglobalised the Config Sort functions\n    - Refactor the Sidebar to be Event-Driven\n    - Refactor the Color Event\n    - Refactor the Commands list\n    - Make ctx_update_tables private\n    - Reduce the scope/deps of some Validator functions\n    - Use the Email's IMAP UID instead of an increasing number as index\n    - debug: log window focus\n- Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch.\n  No longer needed.\n\n- Update to 20200821:\n  * Bug Fixes\n    - fix maildir flag generation\n    - fix query notmuch if file is missing\n    - notmuch: don't abort sync on error\n    - fix type checking for send config variables\n  * Changed Config\n    - $sidebar_format - Use %D rather than %B for named mailboxes\n  * Translations\n    - 96% Lithuanian\n    - 90% Polish\n- fix(sidebar): abbreviate/shorten what user sees\n\n- Fix sidebar mailbox name display problem. \n\n- Update to 20200814:\n  * Notes\n    - Add one-liner docs to config items\n      See: neomutt -O -Q smart_wrap\n    - Remove the built-in editor\n      A large unused and unusable feature\n  * Security\n    - Add mitigation against DoS from thousands of parts\n      boo#1179113\n  * Features\n    - Allow index-style searching in postpone menu\n    - Open NeoMutt using a mailbox name\n    - Add cd command to change the current working directory\n    - Add tab-completion menu for patterns\n    - Allow renaming existing mailboxes\n    - Check for missing attachments in alternative parts\n    - Add one-liner docs to config items\n  * Bug Fixes\n    - Fix logic in checking an empty From address\n    - Fix Imap crash in cmd_parse_expunge()\n    - Fix setting attributes with S-Lang\n    - Fix: redrawing of $pager_index_lines\n    - Fix progress percentage for syncing large mboxes\n    - Fix sidebar drawing in presence of indentation + named mailboxes\n    - Fix retrieval of drafts when 'postponed' is not in the mailboxes list\n    - Do not add comments to address group terminators\n    - Fix alias sorting for degenerate addresses\n    - Fix attaching emails\n    - Create directories for nonexistent file hcache case\n    - Avoid creating mailboxes for failed subscribes\n    - Fix crash if rejecting cert\n  * Changed Config\n    - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed\n    - Change default of $crypt_protected_headers_subject to '...'\n    - Add default keybindings to history-up/down\n  * Translations\n    - 100% Czech\n    - 100% Spanish\n  * Build\n    - Allow building against Lua 5.4\n    - Fix when sqlite3.h is missing\n  * Docs\n    - Add a brief section on stty to the manual\n    - Update section 'Terminal Keybindings' in the manual\n    - Clarify PGP Pseudo-header S\u003cid\u003e duration\n  * Code\n    - Clean up String API\n    - Make the Sidebar more independent\n    - De-centralise the Config Variables\n    - Refactor dialogs\n    - Refactor: Help Bar generation\n    - Make more APIs Context-free\n    - Adjust the edata use in Maildir and Notmuch\n    - Window refactoring\n    - Convert libsend to use Config functions\n    - Refactor notifications to reduce noise\n    - Convert Keymaps to use STAILQ\n    - Track currently selected email by msgid\n    - Config: no backing global variable\n    - Add events for key binding\n  * Upstream\n    - Fix imap postponed mailbox use-after-free error\n    - Speed up thread sort when many long threads exist\n    - Fix ~v tagging when switching to non-threaded sorting\n    - Add message/global to the list of known 'message' types\n    - Print progress meter when copying/saving tagged messages\n    - Remove ansi formatting from autoview generated quoted replies\n    - Change postpone mode to write Date header too\n    - Unstuff format=flowed\n\n- Update to 20200626:\n  * Bug Fixes\n    - Avoid opening the same hcache file twice\n    - Re-open Mailbox after folder-hook\n    - Fix the matching of the spoolfile Mailbox\n    - Fix link-thread to link all tagged emails\n  * Changed Config\n    - Add $tunnel_is_secure config, defaulting to true\n  * Upstream\n    - Don't check IMAP PREAUTH encryption if $tunnel is in use\n    - Add recommendation to use $ssl_force_tls\n- Changes from 20200501:\n  * Security\n    - Abort GnuTLS certificate check if a cert in the chain is rejected\n      CVE-2020-14154 boo#1172906\n    - TLS: clear data after a starttls acknowledgement\n      CVE-2020-14954 boo#1173197\n    - Prevent possible IMAP MITM via PREAUTH response\n      CVE-2020-14093 boo#1172935\n  * Features\n    - add config operations +=/-= for number,long\n    - Address book has a comment field\n    - Query menu has a comment field\n  * Contrib\n     sample.neomuttrc-starter: Do not echo prompted password\n  * Bug Fixes\n    - make 'news://' and 'nntp://' schemes interchangeable\n    - Fix CRLF to LF conversion in base64 decoding\n    - Double comma in query\n    - compose: fix redraw after history\n    - Crash inside empty query menu\n    - mmdf: fix creating new mailbox\n    - mh: fix creating new mailbox\n    - mbox: error out when an mbox/mmdf is a pipe\n    - Fix list-reply by correct parsing of List-Post headers\n    - Decode references according to RFC2047\n    - fix tagged message count\n    - hcache: fix keylen not being considered when building the full key\n    - sidebar: fix path comparison\n    - Don't mess with the original pattern when running IMAP searches\n    - Handle IMAP 'NO' resps by issuing a msg instead of failing badly\n    - imap: use the connection delimiter if provided\n    - Memory leaks\n  * Changed Config\n    - $alias_format default changed to include %c comment\n    - $query_format default changed to include %e extra info\n  * Translations\n    - 100% Lithuanian\n    - 84% French\n    - Log the translation in use\n  * Docs\n    - Add missing commands unbind, unmacro to man pages\n  * Build\n    - Check size of long using LONG_MAX instead of __WORDSIZE\n    - Allow ./configure to not record cflags\n    - fix out-of-tree build\n    - Avoid locating gdbm symbols in qdbm library\n  * Code\n    - Refactor unsafe TAILQ returns\n    - add window notifications\n    - flip negative ifs\n    - Update to latest acutest.h\n    - test: add store tests\n    - test: add compression tests\n    - graphviz: email\n    - make more opcode info available\n    - refactor: main_change_folder()\n    - refactor: mutt_mailbox_next()\n    - refactor: generate_body()\n    - compress: add {min,max}_level to ComprOps\n    - emphasise empty loops: '// do nothing'\n    - prex: convert is_from() to use regex\n    - Refactor IMAP's search routines\n\n- Update to 20200501:\n  * Bug Fixes\n    - Make sure buffers are initialized on error\n    - fix(sidebar): use abbreviated path if possible\n  * Translations\n    - 100% Lithuanian\n  * Docs\n    - make header cache config more explicit\n- Changes from 20200424:\n  * Bug Fixes\n    - Fix history corruption\n    - Handle pretty much anything in a URL query part\n    - Correctly parse escaped characters in header phrases\n    - Fix crash reading received header\n    - Fix sidebar indentation\n    - Avoid crashing on failure to parse an IMAP mailbox\n    - Maildir: handle deleted emails correctly\n    - Ensure OP_NULL is always first\n  * Translations\n    - 100% Czech\n  * Build\n    - cirrus: enable pcre2, make pkgconf a special case\n    - Fix finding pcre2 w/o pkgconf\n    - build: tdb.h needs size_t, bring it in with stddef.h\n- Changes from 20200417:\n  * Features\n    - Fluid layout for Compose Screen, see: vimeo.com/407231157\n    - Trivial Database (TDB) header cache backend\n    - RocksDB header cache backend\n    - Add \u003csidebar-first\u003e and \u003csidebar-last\u003e functions\n  * Bug Fixes\n    - add error for CLI empty emails\n    - Allow spaces and square brackets in paths\n    - browser: fix hidden mailboxes\n    - fix initial email display\n    - notmuch: fix time window search.\n    - fix resize bugs\n    - notmuch: fix entire-thread: update current email pointer\n    - sidebar: support indenting and shortening of names\n    - Handle variables inside backticks in sidebar_whitelist\n    - browser: fix mask regex error reporting\n  * Translations\n    - 100% Lithuanian\n    - 99% Chinese (simplified)\n  * Build\n    - Use regexes for common parsing tasks: urls, dates\n    - Add configure option --pcre2 -- Enable PCRE2 regular expressions\n    - Add configure option --tdb -- Use TDB for the header cache\n    - Add configure option --rocksdb -- Use RocksDB for the header cache\n    - Create libstore (key/value backends)\n    - Update to latest autosetup\n    - Update to latest acutest.h\n    - Rename doc/ directory to docs/\n    - make: fix location of .Po dependency files\n    - Change libcompress to be more universal\n    - Fix test fails on х32\n    - fix uidvalidity to unsigned 32-bit int\n  * Code\n    - Increase test coverage\n    - Fix memory leaks\n    - Fix null checks\n  * Upstream\n    - Buffer refactoring\n    - Fix use-after-free in mutt_str_replace()\n    - Clarify PGP Pseudo-header S\u003cid\u003e duration\n    - Try to respect MUTT_QUIET for IMAP contexts too\n    - Limit recurse depth when parsing mime messages\n\n- Update to 20200320:\n  * Bug Fixes\n    - Fix COLUMNS env var\n    - Fix sync after delete\n    - Fix crash in notmuch\n    - Fix sidebar indent\n    - Fix emptying trash\n    - Fix command line sending\n    - Fix reading large address lists\n    - Resolve symlinks only when necessary\n  * Translations\n    - lithuania 100% Lithuanian\n    - es 96% Spanish\n  * Docs\n    - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output\n    - Fix case of GPGME and SQLite\n  * Build\n    - Create libcompress (lz4, zlib, zstd)\n    - Create libhistory\n    - Create libbcache\n    - Move zstrm to libconn\n  * Code\n    - Add more test coverage\n    - Rename magic to type\n    - Use mutt_file_fopen() on config variables\n    - Change commands to use intptr_t for data\n\n- Update to 20200313:\n  * Window layout\n    - Sidebar is only visible when it's usable.\n  * Features\n    - UI: add number of old messages to sidebar_format\n    - UI: support ISO 8601 calendar date\n    - UI: fix commands that don’t need to have a non-empty mailbox\n      to be valid\n    - PGP: inform about successful decryption of inline PGP\n      messages\n    - PGP: try to infer the signing key from the From address\n    - PGP: enable GPGMe by default\n    - Notmuch: use query as name for vfolder-from-query\n    - IMAP: add network traffic compression\n      (COMPRESS=DEFLATE, RFC4978)\n    - Header cache: add support for generic header cache\n      compression\n  * Bug Fixes\n    - Fix uncollapse_jump\n    - Only try to perform entire-thread on maildir/mh mailboxes\n    - Fix crash in pager\n    - Avoid logging single new lines at the end of header fields\n    - Fix listing mailboxes\n    - Do not recurse a non-threaded message\n    - Fix initial window order\n    - Fix leaks on IMAP error paths\n    - Notmuch: compose(attach-message): support notmuch backend\n    - Fix IMAP flag comparison code\n    - Fix $move for IMAP mailboxes\n    - Maildir: maildir_mbox_check_stats should only update mailbox\n      stats if requested\n    - Fix unmailboxes for virtual mailboxes\n    - Maildir: sanitize filename before hashing\n    - OAuth: if 'login' name isn't available use 'user'\n    - Add error message on failed encryption\n    - Fix a bunch of crashes\n    - Force C locale for email date\n    - Abort if run without a terminal\n  * Changed Config\n    - $crypt_use_gpgme - Now defaults to 'yes' (enabled)\n    - $abort_backspace - Hitting backspace against an empty prompt\n      aborts the prompt\n    - $abort_key - String representation of key to abort prompts\n    - $arrow_string - Use an custom string for arrow_cursor\n    - $crypt_opportunistic_encrypt_strong_keys - Enable encryption\n      only when strong a key is available\n    - $header_cache_compress_dictionary - Filepath to dictionary\n      for zstd compression\n    - $header_cache_compress_level - Level of compression for\n      method\n    - $header_cache_compress_method - Enable generic hcache\n      database compression\n    - $imap_deflate - Compress network traffic\n    - $smtp_user - Username for the SMTP server\n  * Translations\n    - 100% Lithuanian\n    - 81% Spanish\n    - 78% Russian\n  * Build\n    - Add libdebug\n    - Rename public headers to lib.h\n    - Create libcompress for compressed folders code\n  * Code\n    - Refactor Windows and Dialogs\n    - Lots of code tidying\n    - Refactor: mutt_addrlist_{search,write}\n    - Lots of improvements to the Config code\n    - Use Buffers more pervasively\n    - Unify API function naming\n    - Rename library shared headers\n    - Refactor libconn gui dependencies\n    - Refactor: init.[ch]\n    - Refactor config to use subsets\n    - Config: add path type\n    - Remove backend deps from the connection code\n  * Upstream\n    - Allow ~b ~B ~h patterns in send2-hook\n    - Rename smime oppenc mode parameter to get_keys_by_addr()\n    - Add $crypt_opportunistic_encrypt_strong_keys config var\n    - Fix crash when polling a closed ssl connection\n    - Turn off auto-clear outside of autocrypt initialization\n    - Add protected-headers='v1' to Content-Type when protecting\n      headers\n    - Fix segv in IMAP postponed menu caused by reopen_allow\n    - Adding ISO 8601 calendar date\n    - Fix $fcc_attach to not prompt in batch mode\n    - Convert remaining mutt_encode_path() call to use struct\n      Buffer\n    - Fix rendering of replacement_char when Charset_is_utf8\n    - Update to latest acutest.h\n\n- Update to 20191207:\n  * Features:\n    - compose: draw status bar with highlights\n  * Bug Fixes:\n    - crash opening notmuch mailbox\n    - crash in mutt_autocrypt_ui_recommendation\n    - Avoid negative allocation\n    - Mbox new mail\n    - Setting of DT_MAILBOX type variables from Lua\n    - imap: empty cmdbuf before connecting\n    - imap: select the mailbox on reconnect\n    - compose: fix attach message\n  * Build:\n    - make files conditional\n  * Code:\n    - enum-ify log levels\n    - fix function prototypes\n    - refactor virtual email lookups\n    - factor out global Context\n- Changes from 20191129:\n  * Features:\n    - Add raw mailsize expando (%cr)\n  * Bug Fixes:\n    - Avoid double question marks in bounce confirmation msg\n    - Fix bounce confirmation\n    - fix new-mail flags and behaviour\n    - fix: browser \u003cdescend-directory\u003e\n    - fix ssl crash\n    - fix move to trash\n    - fix flickering\n    - Do not check hidden mailboxes for new mail\n    - Fix new_mail_command notifications\n    - fix crash in examine_mailboxes()\n    - fix crash in mutt_sort_threads()\n    - fix: crash after sending\n    - Fix crash in tunnel's conn_close\n    - fix fcc for deep dirs\n    - imap: fix crash when new mail arrives\n    - fix colour 'quoted9'\n    - quieten messages on exit\n    - fix: crash after failed mbox_check\n    - browser: default to a file/dir view when attaching a file\n  * Changed Config:\n    - Change $write_bcc to default off\n  * Docs:\n    - Add a bit more documentation about sending\n    - Clarify $write_bcc documentation.\n    - Update documentation for raw size expando\n    - docbook: set generate.consistent.ids to make generated html\n      reproducible\n  * Build:\n    - fix build/tests for 32-bit arches\n    - tests: fix test that would fail soon\n    - tests: fix context for failing idna tests\n\n- Update to 20191111:\n  Bug fixes:\n  * browser: fix directory view\n  * fix crash in mutt_extract_token()\n  * force a screen refresh\n  * fix crash sending message from command line\n  * notmuch: use nm_default_uri if no mailbox data\n  * fix forward attachments\n  * fix: vfprintf undefined behaviour in body_handler\n  * Fix relative symlink resolution\n  * fix: trash to non-existent file/dir\n  * fix re-opening of mbox Mailboxes\n  * close logging as late as possible\n  * log unknown mailboxes\n  * fix crash in command line postpone\n  * fix memory leaks\n  * fix icommand parsing\n  * fix new mail interaction with mail_check_recent\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-12-04T09:23:27Z","modified":"2026-02-04T03:16:11.263889Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2158-1","title":"Security update for neomutt","description":"This update for neomutt fixes the following issues:\n\nUpdate neomutt to 20201120. Address boo#1179035, CVE-2020-28896.\n\n  * Security\n    - imap: close connection on all failures\n  * Features\n    - alias: add function to Alias/Query dialogs\n    - config: add validators for {imap,smtp,pop}_authenticators\n    - config: warn when signature file is missing or not readable\n    - smtp: support for native SMTP LOGIN auth mech\n    - notmuch: show originating folder in index\n  * Bug Fixes\n    - sidebar: prevent the divider colour bleeding out\n    - sidebar: fix \u003csidebar-{next,prev}-new\u003e\n    - notmuch: fix query for current email\n    - restore shutdown-hook functionality\n    - crash in reply-to\n    - user-after-free in folder-hook\n    - fix some leaks\n    - fix application of limits to modified mailboxes\n    - write Date header when postponing\n  * Translations\n    - 100% Lithuanian\n    - 100% Czech\n    - 70% Turkish\n  * Docs\n    - Document that $sort_alias affects the query menu\n  * Build\n    - improve ASAN flags\n    - add SASL and S/MIME to --everything\n    - fix contrib (un)install\n  * Code\n    - my_hdr compose screen notifications\n    - add contracts to the MXAPI\n    - maildir refactoring\n    - further reduce the use of global variables\n  * Upstream\n    - Add $count_alternatives to count attachments inside alternatives\n- Changes from 20200925\n  * Features\n    - Compose: display user-defined headers\n    - Address Book / Query: live sorting\n    - Address Book / Query: patterns for searching\n    - Config: Add '+=' and '-=' operators for String Lists\n    - Config: Add '+=' operator for Strings\n    - Allow postfix query ':setenv NAME?' for env vars\n  * Bug Fixes\n    - Fix crash when searching with invalid regexes\n    - Compose: Prevent infinite loop of send2-hooks\n    - Fix sidebar on new/removed mailboxes\n    - Restore indentation for named mailboxes\n    - Prevent half-parsing an alias\n    - Remove folder creation prompt for POP path\n    - Show error if $message_cachedir doesn't point to a valid directory\n    - Fix tracking LastDir in case of IMAP paths with Unicode characters\n    - Make sure all mail gets applied the index limit\n    - Add warnings to -Q query CLI option\n    - Fix index tracking functionality\n  * Changed Config\n    - Add $compose_show_user_headers (yes)\n  * Translations\n    - 100% Czech\n    - 100% Lithuanian\n    - Split up usage strings\n  * Build\n    - Run shellcheck on hcachever.sh\n    - Add the Address Sanitizer\n    - Move compose files to lib under compose/\n    - Move address config into libaddress\n    - Update to latest acutest - fixes a memory leak in the unit tests\n  * Code\n    - Implement ARRAY API\n    - Deglobalised the Config Sort functions\n    - Refactor the Sidebar to be Event-Driven\n    - Refactor the Color Event\n    - Refactor the Commands list\n    - Make ctx_update_tables private\n    - Reduce the scope/deps of some Validator functions\n    - Use the Email's IMAP UID instead of an increasing number as index\n    - debug: log window focus\n- Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch.\n  No longer needed.\n\n- Update to 20200821:\n  * Bug Fixes\n    - fix maildir flag generation\n    - fix query notmuch if file is missing\n    - notmuch: don't abort sync on error\n    - fix type checking for send config variables\n  * Changed Config\n    - $sidebar_format - Use %D rather than %B for named mailboxes\n  * Translations\n    - 96% Lithuanian\n    - 90% Polish\n- fix(sidebar): abbreviate/shorten what user sees\n\n- Fix sidebar mailbox name display problem. \n\n- Update to 20200814:\n  * Notes\n    - Add one-liner docs to config items\n      See: neomutt -O -Q smart_wrap\n    - Remove the built-in editor\n      A large unused and unusable feature\n  * Security\n    - Add mitigation against DoS from thousands of parts\n      boo#1179113\n  * Features\n    - Allow index-style searching in postpone menu\n    - Open NeoMutt using a mailbox name\n    - Add cd command to change the current working directory\n    - Add tab-completion menu for patterns\n    - Allow renaming existing mailboxes\n    - Check for missing attachments in alternative parts\n    - Add one-liner docs to config items\n  * Bug Fixes\n    - Fix logic in checking an empty From address\n    - Fix Imap crash in cmd_parse_expunge()\n    - Fix setting attributes with S-Lang\n    - Fix: redrawing of $pager_index_lines\n    - Fix progress percentage for syncing large mboxes\n    - Fix sidebar drawing in presence of indentation + named mailboxes\n    - Fix retrieval of drafts when 'postponed' is not in the mailboxes list\n    - Do not add comments to address group terminators\n    - Fix alias sorting for degenerate addresses\n    - Fix attaching emails\n    - Create directories for nonexistent file hcache case\n    - Avoid creating mailboxes for failed subscribes\n    - Fix crash if rejecting cert\n  * Changed Config\n    - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed\n    - Change default of $crypt_protected_headers_subject to '...'\n    - Add default keybindings to history-up/down\n  * Translations\n    - 100% Czech\n    - 100% Spanish\n  * Build\n    - Allow building against Lua 5.4\n    - Fix when sqlite3.h is missing\n  * Docs\n    - Add a brief section on stty to the manual\n    - Update section 'Terminal Keybindings' in the manual\n    - Clarify PGP Pseudo-header S\u003cid\u003e duration\n  * Code\n    - Clean up String API\n    - Make the Sidebar more independent\n    - De-centralise the Config Variables\n    - Refactor dialogs\n    - Refactor: Help Bar generation\n    - Make more APIs Context-free\n    - Adjust the edata use in Maildir and Notmuch\n    - Window refactoring\n    - Convert libsend to use Config functions\n    - Refactor notifications to reduce noise\n    - Convert Keymaps to use STAILQ\n    - Track currently selected email by msgid\n    - Config: no backing global variable\n    - Add events for key binding\n  * Upstream\n    - Fix imap postponed mailbox use-after-free error\n    - Speed up thread sort when many long threads exist\n    - Fix ~v tagging when switching to non-threaded sorting\n    - Add message/global to the list of known 'message' types\n    - Print progress meter when copying/saving tagged messages\n    - Remove ansi formatting from autoview generated quoted replies\n    - Change postpone mode to write Date header too\n    - Unstuff format=flowed\n\n- Update to 20200626:\n  * Bug Fixes\n    - Avoid opening the same hcache file twice\n    - Re-open Mailbox after folder-hook\n    - Fix the matching of the spoolfile Mailbox\n    - Fix link-thread to link all tagged emails\n  * Changed Config\n    - Add $tunnel_is_secure config, defaulting to true\n  * Upstream\n    - Don't check IMAP PREAUTH encryption if $tunnel is in use\n    - Add recommendation to use $ssl_force_tls\n- Changes from 20200501:\n  * Security\n    - Abort GnuTLS certificate check if a cert in the chain is rejected\n      CVE-2020-14154 boo#1172906\n    - TLS: clear data after a starttls acknowledgement\n      CVE-2020-14954 boo#1173197\n    - Prevent possible IMAP MITM via PREAUTH response\n      CVE-2020-14093 boo#1172935\n  * Features\n    - add config operations +=/-= for number,long\n    - Address book has a comment field\n    - Query menu has a comment field\n  * Contrib\n     sample.neomuttrc-starter: Do not echo prompted password\n  * Bug Fixes\n    - make 'news://' and 'nntp://' schemes interchangeable\n    - Fix CRLF to LF conversion in base64 decoding\n    - Double comma in query\n    - compose: fix redraw after history\n    - Crash inside empty query menu\n    - mmdf: fix creating new mailbox\n    - mh: fix creating new mailbox\n    - mbox: error out when an mbox/mmdf is a pipe\n    - Fix list-reply by correct parsing of List-Post headers\n    - Decode references according to RFC2047\n    - fix tagged message count\n    - hcache: fix keylen not being considered when building the full key\n    - sidebar: fix path comparison\n    - Don't mess with the original pattern when running IMAP searches\n    - Handle IMAP 'NO' resps by issuing a msg instead of failing badly\n    - imap: use the connection delimiter if provided\n    - Memory leaks\n  * Changed Config\n    - $alias_format default changed to include %c comment\n    - $query_format default changed to include %e extra info\n  * Translations\n    - 100% Lithuanian\n    - 84% French\n    - Log the translation in use\n  * Docs\n    - Add missing commands unbind, unmacro to man pages\n  * Build\n    - Check size of long using LONG_MAX instead of __WORDSIZE\n    - Allow ./configure to not record cflags\n    - fix out-of-tree build\n    - Avoid locating gdbm symbols in qdbm library\n  * Code\n    - Refactor unsafe TAILQ returns\n    - add window notifications\n    - flip negative ifs\n    - Update to latest acutest.h\n    - test: add store tests\n    - test: add compression tests\n    - graphviz: email\n    - make more opcode info available\n    - refactor: main_change_folder()\n    - refactor: mutt_mailbox_next()\n    - refactor: generate_body()\n    - compress: add {min,max}_level to ComprOps\n    - emphasise empty loops: '// do nothing'\n    - prex: convert is_from() to use regex\n    - Refactor IMAP's search routines\n\n- Update to 20200501:\n  * Bug Fixes\n    - Make sure buffers are initialized on error\n    - fix(sidebar): use abbreviated path if possible\n  * Translations\n    - 100% Lithuanian\n  * Docs\n    - make header cache config more explicit\n- Changes from 20200424:\n  * Bug Fixes\n    - Fix history corruption\n    - Handle pretty much anything in a URL query part\n    - Correctly parse escaped characters in header phrases\n    - Fix crash reading received header\n    - Fix sidebar indentation\n    - Avoid crashing on failure to parse an IMAP mailbox\n    - Maildir: handle deleted emails correctly\n    - Ensure OP_NULL is always first\n  * Translations\n    - 100% Czech\n  * Build\n    - cirrus: enable pcre2, make pkgconf a special case\n    - Fix finding pcre2 w/o pkgconf\n    - build: tdb.h needs size_t, bring it in with stddef.h\n- Changes from 20200417:\n  * Features\n    - Fluid layout for Compose Screen, see: vimeo.com/407231157\n    - Trivial Database (TDB) header cache backend\n    - RocksDB header cache backend\n    - Add \u003csidebar-first\u003e and \u003csidebar-last\u003e functions\n  * Bug Fixes\n    - add error for CLI empty emails\n    - Allow spaces and square brackets in paths\n    - browser: fix hidden mailboxes\n    - fix initial email display\n    - notmuch: fix time window search.\n    - fix resize bugs\n    - notmuch: fix entire-thread: update current email pointer\n    - sidebar: support indenting and shortening of names\n    - Handle variables inside backticks in sidebar_whitelist\n    - browser: fix mask regex error reporting\n  * Translations\n    - 100% Lithuanian\n    - 99% Chinese (simplified)\n  * Build\n    - Use regexes for common parsing tasks: urls, dates\n    - Add configure option --pcre2 -- Enable PCRE2 regular expressions\n    - Add configure option --tdb -- Use TDB for the header cache\n    - Add configure option --rocksdb -- Use RocksDB for the header cache\n    - Create libstore (key/value backends)\n    - Update to latest autosetup\n    - Update to latest acutest.h\n    - Rename doc/ directory to docs/\n    - make: fix location of .Po dependency files\n    - Change libcompress to be more universal\n    - Fix test fails on х32\n    - fix uidvalidity to unsigned 32-bit int\n  * Code\n    - Increase test coverage\n    - Fix memory leaks\n    - Fix null checks\n  * Upstream\n    - Buffer refactoring\n    - Fix use-after-free in mutt_str_replace()\n    - Clarify PGP Pseudo-header S\u003cid\u003e duration\n    - Try to respect MUTT_QUIET for IMAP contexts too\n    - Limit recurse depth when parsing mime messages\n\n- Update to 20200320:\n  * Bug Fixes\n    - Fix COLUMNS env var\n    - Fix sync after delete\n    - Fix crash in notmuch\n    - Fix sidebar indent\n    - Fix emptying trash\n    - Fix command line sending\n    - Fix reading large address lists\n    - Resolve symlinks only when necessary\n  * Translations\n    - lithuania 100% Lithuanian\n    - es 96% Spanish\n  * Docs\n    - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output\n    - Fix case of GPGME and SQLite\n  * Build\n    - Create libcompress (lz4, zlib, zstd)\n    - Create libhistory\n    - Create libbcache\n    - Move zstrm to libconn\n  * Code\n    - Add more test coverage\n    - Rename magic to type\n    - Use mutt_file_fopen() on config variables\n    - Change commands to use intptr_t for data\n\n- Update to 20200313:\n  * Window layout\n    - Sidebar is only visible when it's usable.\n  * Features\n    - UI: add number of old messages to sidebar_format\n    - UI: support ISO 8601 calendar date\n    - UI: fix commands that don’t need to have a non-empty mailbox\n      to be valid\n    - PGP: inform about successful decryption of inline PGP\n      messages\n    - PGP: try to infer the signing key from the From address\n    - PGP: enable GPGMe by default\n    - Notmuch: use query as name for vfolder-from-query\n    - IMAP: add network traffic compression\n      (COMPRESS=DEFLATE, RFC4978)\n    - Header cache: add support for generic header cache\n      compression\n  * Bug Fixes\n    - Fix uncollapse_jump\n    - Only try to perform entire-thread on maildir/mh mailboxes\n    - Fix crash in pager\n    - Avoid logging single new lines at the end of header fields\n    - Fix listing mailboxes\n    - Do not recurse a non-threaded message\n    - Fix initial window order\n    - Fix leaks on IMAP error paths\n    - Notmuch: compose(attach-message): support notmuch backend\n    - Fix IMAP flag comparison code\n    - Fix $move for IMAP mailboxes\n    - Maildir: maildir_mbox_check_stats should only update mailbox\n      stats if requested\n    - Fix unmailboxes for virtual mailboxes\n    - Maildir: sanitize filename before hashing\n    - OAuth: if 'login' name isn't available use 'user'\n    - Add error message on failed encryption\n    - Fix a bunch of crashes\n    - Force C locale for email date\n    - Abort if run without a terminal\n  * Changed Config\n    - $crypt_use_gpgme - Now defaults to 'yes' (enabled)\n    - $abort_backspace - Hitting backspace against an empty prompt\n      aborts the prompt\n    - $abort_key - String representation of key to abort prompts\n    - $arrow_string - Use an custom string for arrow_cursor\n    - $crypt_opportunistic_encrypt_strong_keys - Enable encryption\n      only when strong a key is available\n    - $header_cache_compress_dictionary - Filepath to dictionary\n      for zstd compression\n    - $header_cache_compress_level - Level of compression for\n      method\n    - $header_cache_compress_method - Enable generic hcache\n      database compression\n    - $imap_deflate - Compress network traffic\n    - $smtp_user - Username for the SMTP server\n  * Translations\n    - 100% Lithuanian\n    - 81% Spanish\n    - 78% Russian\n  * Build\n    - Add libdebug\n    - Rename public headers to lib.h\n    - Create libcompress for compressed folders code\n  * Code\n    - Refactor Windows and Dialogs\n    - Lots of code tidying\n    - Refactor: mutt_addrlist_{search,write}\n    - Lots of improvements to the Config code\n    - Use Buffers more pervasively\n    - Unify API function naming\n    - Rename library shared headers\n    - Refactor libconn gui dependencies\n    - Refactor: init.[ch]\n    - Refactor config to use subsets\n    - Config: add path type\n    - Remove backend deps from the connection code\n  * Upstream\n    - Allow ~b ~B ~h patterns in send2-hook\n    - Rename smime oppenc mode parameter to get_keys_by_addr()\n    - Add $crypt_opportunistic_encrypt_strong_keys config var\n    - Fix crash when polling a closed ssl connection\n    - Turn off auto-clear outside of autocrypt initialization\n    - Add protected-headers='v1' to Content-Type when protecting\n      headers\n    - Fix segv in IMAP postponed menu caused by reopen_allow\n    - Adding ISO 8601 calendar date\n    - Fix $fcc_attach to not prompt in batch mode\n    - Convert remaining mutt_encode_path() call to use struct\n      Buffer\n    - Fix rendering of replacement_char when Charset_is_utf8\n    - Update to latest acutest.h\n\n- Update to 20191207:\n  * Features:\n    - compose: draw status bar with highlights\n  * Bug Fixes:\n    - crash opening notmuch mailbox\n    - crash in mutt_autocrypt_ui_recommendation\n    - Avoid negative allocation\n    - Mbox new mail\n    - Setting of DT_MAILBOX type variables from Lua\n    - imap: empty cmdbuf before connecting\n    - imap: select the mailbox on reconnect\n    - compose: fix attach message\n  * Build:\n    - make files conditional\n  * Code:\n    - enum-ify log levels\n    - fix function prototypes\n    - refactor virtual email lookups\n    - factor out global Context\n- Changes from 20191129:\n  * Features:\n    - Add raw mailsize expando (%cr)\n  * Bug Fixes:\n    - Avoid double question marks in bounce confirmation msg\n    - Fix bounce confirmation\n    - fix new-mail flags and behaviour\n    - fix: browser \u003cdescend-directory\u003e\n    - fix ssl crash\n    - fix move to trash\n    - fix flickering\n    - Do not check hidden mailboxes for new mail\n    - Fix new_mail_command notifications\n    - fix crash in examine_mailboxes()\n    - fix crash in mutt_sort_threads()\n    - fix: crash after sending\n    - Fix crash in tunnel's conn_close\n    - fix fcc for deep dirs\n    - imap: fix crash when new mail arrives\n    - fix colour 'quoted9'\n    - quieten messages on exit\n    - fix: crash after failed mbox_check\n    - browser: default to a file/dir view when attaching a file\n  * Changed Config:\n    - Change $write_bcc to default off\n  * Docs:\n    - Add a bit more documentation about sending\n    - Clarify $write_bcc documentation.\n    - Update documentation for raw size expando\n    - docbook: set generate.consistent.ids to make generated html\n      reproducible\n  * Build:\n    - fix build/tests for 32-bit arches\n    - tests: fix test that would fail soon\n    - tests: fix context for failing idna tests\n\n- Update to 20191111:\n  Bug fixes:\n  * browser: fix directory view\n  * fix crash in mutt_extract_token()\n  * force a screen refresh\n  * fix crash sending message from command line\n  * notmuch: use nm_default_uri if no mailbox data\n  * fix forward attachments\n  * fix: vfprintf undefined behaviour in body_handler\n  * Fix relative symlink resolution\n  * fix: trash to non-existent file/dir\n  * fix re-opening of mbox Mailboxes\n  * close logging as late as possible\n  * log unknown mailboxes\n  * fix crash in command line postpone\n  * fix memory leaks\n  * fix icommand parsing\n  * fix new mail interaction with mail_check_recent\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-12-04T09:23:31Z","modified":"2026-02-04T04:12:21.950435Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11079-1","title":"neomutt-20210205-3.3 on GA media","description":"These are all security issues fixed in the neomutt-20210205-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:27.947361Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13279-1","title":"mutt-2.2.12-2.1 on GA media","description":"These are all security issues fixed in the mutt-2.2.12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:10.914324Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2020:14414-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was\n  affecting IMAP, SMTP, and POP3 (bsc#1173197).\t  \n- CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).\n- CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).\t  \n","status":"published","published":"2020-06-30T09:30:09Z","modified":"2026-02-04T03:40:43.851747Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1771-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was \n  affecting IMAP, SMTP, and POP3 (bsc#1173197).\n- CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).\n- CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was \n  proceeding with a connection (bsc#1172906, bsc#1172935). \n","status":"published","published":"2020-06-26T06:04:41Z","modified":"2026-02-04T03:23:19.164409Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1794-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was\n  affecting IMAP, SMTP, and POP3 (bsc#1173197).\n- CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).\n- CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was\n  proceeding with a connection (bsc#1172906, bsc#1172935).\n","status":"published","published":"2020-06-29T09:10:31Z","modified":"2026-02-04T04:06:55.765919Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4401-1","title":"mutt vulnerabilities","description":"It was discovered that Mutt incorrectly handled certain requests.\nAn attacker could possibly use this issue to enable MITM attacks.\n(CVE-2020-14093)\n\nIt was discovered that Mutt incorrectly handled certain requests.\nAn attacker could possibly use this issue to proceeds with a connection\neven if the user rejects an expired intermediate certificate.\n(CVE-2020-14154)\n","status":"published","published":"2020-06-22T14:20:02Z","modified":"2026-02-10T04:41:51Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}