{"id":"CVE-2023-4875","aliases":["ALSA-2024:2290","ALSA-2024:3058","AZL-28699","CLSA-2026-1779825075","DEBIAN-CVE-2023-4875","DLA-3574-1","DSA-5494-1","EUVD-2023-54714","GHSA-fwwc-f8hw-qfwf","MGASA-2024-0175","OESA-2023-1660","RHSA-2024:2290","RHSA-2024:3058","RLSA-2024:2290","RLSA-2024:3058","SUSE-SU-2023:3702-1","SUSE-SU-2023:3826-1","UBUNTU-CVE-2023-4875","USN-6374-1","openSUSE-SU-2024:13222-1"],"status":"published","title":"Undefined Behavior for Input to API in Mutt","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","severity":{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00553,"percentile":0.4644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-475","CWE-476"],"published":"2023-09-09T14:30:24Z","modified":"2026-10-29T11:31:08Z","fixes":[{"ecosystem":"Azure Linux:2","package":"mutt","fixed_in":["2.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mutt","fixed_in":["2.2.9-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mutt","fixed_in":["2.2.12-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mutt","fixed_in":["2.2.12-0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mutt","fixed_in":["1.5.24-1ubuntu0.6+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mutt","fixed_in":["1.9.4-3ubuntu0.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mutt","fixed_in":["1.13.2-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"mutt","fixed_in":["2.1.4-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1+deb12u1"}]}],"versions":["2.2.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-0.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-2.1+deb10u7"}]}],"versions":["1.10.1-2.1","1.10.1-2.1+deb10u1","1.10.1-2.1+deb10u2","1.10.1-2.1+deb10u3","1.10.1-2.1+deb10u4","1.10.1-2.1+deb10u5","1.10.1-2.1+deb10u6"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-4.1+deb11u3"}]}],"versions":["2.0.5-4.1","2.0.5-4.1+deb11u1","2.0.5-4.1+deb11u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1+deb12u1"}]}],"versions":["2.2.9-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mutt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mutt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150000.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150000.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150000.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150000.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150000.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150000.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.24-1ubuntu0.6+esm3"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5","1.5.24-1ubuntu0.6","1.5.24-1ubuntu0.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu0.6+esm1"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4","1.9.4-3ubuntu0.5","1.9.4-3ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1ubuntu0.6"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3","1.13.2-1ubuntu0.4","1.13.2-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.2"}]}],"versions":["2.0.5-4.1build1","2.1.3-1","2.1.4-1","2.1.4-1build1","2.1.4-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.24-1ubuntu0.6+esm3"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5","1.5.24-1ubuntu0.6","1.5.24-1ubuntu0.6+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu0.6+esm1"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4","1.9.4-3ubuntu0.5","1.9.4-3ubuntu0.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1ubuntu0.6"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3","1.13.2-1ubuntu0.4","1.13.2-1ubuntu0.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.2"}]}],"versions":["2.0.5-4.1build1","2.1.3-1","2.1.4-1","2.1.4-1build1","2.1.4-1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mutt","product":"mutt"}],"references":[{"url":"https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch","tags":["x_transferred","Patch","fix","article","report"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6.patch","tags":["x_transferred","Patch","fix","article","report"]},{"url":"https://www.debian.org/security/2023/dsa-5494","tags":["x_transferred","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00021.html","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/26/6","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4875","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fwwc-f8hw-qfwf"},{"url":"https://access.redhat.com/errata/RHSA-2024:2290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4874","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238240","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238241","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2290.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3058","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3058.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779825075.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4875.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-4875","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0175.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33161","tags":["report"]},{"url":"https://lwn.net/Articles/971683/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4874","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238241","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2290.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4874","tags":["advisory"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0.patch","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4875","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3058.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2290","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3058","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233702-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215189","tags":["report"]},{"url":"https://bugzilla.suse.com/1215191","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4875","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233826-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4875","tags":["report"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555","tags":["report"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6","tags":["report"]},{"url":"http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/09/09/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6374-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6374-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4874","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4875","title":"Undefined Behavior for Input to API in Mutt","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T14:30:24.864Z","modified":"2026-07-25T04:10:34.834Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-475"],"updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-54714","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T14:30:24Z","modified":"2026-07-25T04:10:34Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T18:19:38.034212Z"}],"ghsa":[{"id":"GHSA-fwwc-f8hw-qfwf","title":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2...","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T15:30:13Z","modified":"2024-04-04T07:34:32Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-475","CWE-476"],"updated_at":"2026-11-02T14:56:52.639328Z"}],"nvd":[{"id":"CVE-2023-4875","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T15:15:35.5Z","modified":"2026-06-17T06:38:48.433Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-475","CWE-476"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"AZL-28699","title":"CVE-2023-4875 affecting package mutt for versions less than 2.2.12-1","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T15:15:35Z","modified":"2026-04-21T04:25:58.183632Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2023-4875","title":"Undefined Behavior for Input to API in Mutt","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T14:30:24.864Z","modified":"2026-10-28T10:35:31.11526661Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-475"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-4875","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T15:15:35.5Z","modified":"2026-10-26T18:03:07.416395023Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2023-1660","title":"mutt security update","description":"Mutt is a small but very powerful text-based mail client for Unix operating systems.\r\n\r\nSecurity Fix(es):\r\n\r\nNull pointer dereference when viewing a specially crafted email in Mutt \u0026gt;1.5.2 \u0026lt;2.2.12(CVE-2023-4874)\r\n\r\nNull pointer dereference when composing from a specially crafted draft message in Mutt \u0026gt;1.5.2 \u0026lt;2.2.12(CVE-2023-4875)","status":"published","published":"2023-09-22T11:06:06Z","modified":"2026-08-18T01:16:49.030534009Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2024:2290","title":"Red Hat Security Advisory: mutt security update","status":"published","published":"2024-09-16T16:51:42Z","modified":"2026-07-24T10:02:08Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3058","title":"Red Hat Security Advisory: mutt security update","status":"published","published":"2024-09-16T16:51:51Z","modified":"2026-07-24T10:02:16Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:2290","title":"Moderate: mutt security update","description":"Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.\n\nSecurity Fix(es):\n\n* mutt: null pointer dereference (CVE-2023-4874)\n\n* mutt: null pointer dereference (CVE-2023-4875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:13:09.903227Z","modified":"2025-10-07T17:38:04.580237Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-4875","description":"Null pointer dereference when composing from a specially crafted draft message in Mutt \u003e1.5.2 \u003c2.2.12","status":"published","published":"2023-09-09T15:15:00Z","modified":"2026-02-04T02:26:50.320426Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"ALSA-2024:2290","title":"Moderate: mutt security update","description":"Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.\n\nSecurity Fix(es):\n\n* mutt: null pointer dereference (CVE-2023-4874)\n* mutt: null pointer dereference (CVE-2023-4875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:08.400185491Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3058","title":"Moderate: mutt security update","description":"Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.\n\nSecurity Fix(es):\n\n* mutt: null pointer dereference (CVE-2023-4874)\n* mutt: null pointer dereference (CVE-2023-4875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.591174209Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1779825075","title":"mutt: Fix of 2 CVEs","description":"- CVE-2023-4874: fix NULL pointer dereference in write_one_header()\n- CVE-2023-4875: fix NULL pointer dereference in userhdrs handling","status":"published","published":"2026-05-26T19:51:19Z","modified":"2026-10-26T09:30:07.674418354Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-3574-1","title":"mutt - security update","status":"published","published":"2023-09-20T00:00:00Z","modified":"2026-03-09T01:23:01.679582Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5494-1","title":"mutt - security update","status":"published","published":"2023-09-10T00:00:00Z","modified":"2026-03-09T02:09:49.039065Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0175","title":"Updated mutt packages fix security vulnerabilities","description":"Null pointer dereference when viewing a specially crafted email in Mutt\n\u003e1.5.2 \u003c2.2.12. (CVE-2023-4874)\nNull pointer dereference when composing from a specially crafted draft\nmessage in Mutt \u003e1.5.2 \u003c2.2.12. (CVE-2023-4875)\n","status":"published","published":"2024-05-13T14:23:47Z","modified":"2026-04-16T04:43:50.545087477Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13222-1","title":"mutt-2.2.12-1.1 on GA media","description":"These are all security issues fixed in the mutt-2.2.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:58.183297Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2024:3058","title":"Moderate: mutt security update","description":"Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.\n\nSecurity Fix(es):\n\n* mutt: null pointer dereference (CVE-2023-4874)\n\n* mutt: null pointer dereference (CVE-2023-4875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-05T14:00:11.414684Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:3702-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2023-4874: Fixed NULL pointer dereference when composing an email (bsc#1215189).\n- CVE-2023-4875: Fixed NULL pointer dereference when receiving an email (bsc#1215191).\n","status":"published","published":"2023-09-20T10:59:11Z","modified":"2026-02-04T02:33:08.524122Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3826-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues:\n\n- CVE-2023-4874: Fixed NULL pointer dereference when composing an email (bsc#1215189).\n- CVE-2023-4875: Fixed NULL pointer dereference when receiving an email (bsc#1215191).\n","status":"published","published":"2023-09-27T16:59:47Z","modified":"2026-02-04T02:19:26.055789Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6374-1","title":"mutt vulnerabilities","description":"It was discovered that Mutt incorrectly handled certain email header\ncontents. If a user were tricked into opening a specially crafted message,\na remote attacker could possibly use this issue to cause a denial of\nservice. (CVE-2023-4874, CVE-2023-4875)\n","status":"published","published":"2023-09-14T21:34:35Z","modified":"2026-06-25T13:32:20.599850305Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}