Bug 1075860 (CVE-2014-0467)

The Debian DSA-2874-1 security advisory (http://www.debian.org/security/2014/dsa-2874) corrected an overflow in the mutt mail reader. Analysis of the crash reveals this is likely a heap-based buffer overflow in the mutt_copy_hdr() function. Opening a specially-crafted mail message could cause mutt to crash or, potentially, execute arbitrary code. The fix looks to be as follows:

+diff -r 3d5e23a66a1a -r 9bf7593e3c08 copy.c
+--- a/copy.c   Thu Oct 24 09:55:36 2013 -0700
++++ b/copy.c   Tue Mar 11 09:40:09 2014 -0700
+@@ -254,6 +254,7 @@
+     {
+       if (!address_header_decode (&this_one))
+       rfc2047_decode (&this_one);
++      this_one_len = mutt_strlen (this_one);
+     }
+     
+     if (!headers[x])
+

(Note as this is copied from the Debian diff, it is actually a one line change of "this_one_len = mutt_strlen (this_one);")

From brief testing on Red Hat Enterprise Linux 6, the message's headers had to be viewed (via the "h" command) in order to trigger the issue.

Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708731