Red Hat Bugzilla – Bug 1075860
CVE-2014-0467 mutt: heap-based buffer overflow when parsing certain headers
Last modified: 2015-11-25 05:02:28 EST
The Debian DSA-2874-1 security advisory (http://www.debian.org/security/2014/dsa-2874) corrected an overflow in the mutt mail reader. Analysis of the crash reveals this is likely a heap-based buffer overflow in the mutt_copy_hdr() function. Opening a specially-crafted mail message could cause mutt to crash or, potentially, execute arbitrary code. The fix looks to be as follows: +diff -r 3d5e23a66a1a -r 9bf7593e3c08 copy.c +--- a/copy.c Thu Oct 24 09:55:36 2013 -0700 ++++ b/copy.c Tue Mar 11 09:40:09 2014 -0700 +@@ -254,6 +254,7 @@ + { + if (!address_header_decode (&this_one)) + rfc2047_decode (&this_one); ++ this_one_len = mutt_strlen (this_one); + } + + if (!headers[x]) + (Note as this is copied from the Debian diff, it is actually a one line change of "this_one_len = mutt_strlen (this_one);") From brief testing on Red Hat Enterprise Linux 6, the message's headers had to be viewed (via the "h" command) in order to trigger the issue. Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708731
Created mutt tracking bugs for this issue: Affects: fedora-all [bug 1075862]
This was fixed in the upstream 1.5.23 release: ftp://ftp.mutt.org/mutt/diff-1.5.22-1.5.23.gz
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0304 https://rhn.redhat.com/errata/RHSA-2014-0304.html
Statement: This issue does not affect the version of mutt package as shipped with Red Hat Enterprise Linux 5.
mutt-1.5.23-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
mutt-1.5.23-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
mutt-1.5.23-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.