CVE-2018-14349 - mutt: Heap Overflow in imap/command.c

CRITICAL

mutt: Heap Overflow in imap/command.c

Published Jul 17, 2018

9.8

CRITICAL

CVSS 3.1

EPSS 3.17%

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	mutt	Will not fix	n/a
Red Hat Enterprise Linux 6	mutt	Will not fix	n/a
Red Hat Enterprise Linux 7	mutt	Fix deferred	n/a
Red Hat Enterprise Linux 8	mutt	Not affected	n/a

No remediation recorded yet.

Weaknesses (2)

CWE-122

CWE-20

Improper Input Validation

Link	Providers	Tags
http://www.mutt.org/news.html		x_refsource_MISCRelease NotesVendor Advisory
https://access.redhat.com/security/cve/CVE-2018-14349		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1602934		Issue Tracking
https://github.com/neomutt/neomutt/commit/36a29280448097f34ce9c94606195f2ac643fed1		x_refsource_MISCPatchThird Party Advisory
https://gitlab.com/muttmua/mutt/commit/9347b5c01dc52682cb6be11539d9b7ebceae4416		x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://neomutt.org/2018/07/16/release		x_refsource_MISCRelease NotesVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-14349
https://security.gentoo.org/glsa/201810-07		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://usn.ubuntu.com/3719-3/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-14349
https://www.debian.org/security/2018/dsa-4277		vendor-advisoryx_refsource_DEBIANThird Party Advisory