The Debian DSA-2874-1 security advisory (http://www.debian.org/security/2014/dsa-2874) corrected an overflow in the mutt mail reader. Analysis of the crash reveals this is likely a heap-based buffer overflow in the mutt_copy_hdr() function. Opening a specially-crafted mail message could cause mutt to crash or, potentially, execute arbitrary code. The fix looks to be as follows:
+diff -r 3d5e23a66a1a -r 9bf7593e3c08 copy.c
+--- a/copy.c Thu Oct 24 09:55:36 2013 -0700
++++ b/copy.c Tue Mar 11 09:40:09 2014 -0700
+@@ -254,6 +254,7 @@
+ if (!address_header_decode (&this_one))
+ rfc2047_decode (&this_one);
++ this_one_len = mutt_strlen (this_one);
+ if (!headers[x])
(Note as this is copied from the Debian diff, it is actually a one line change of "this_one_len = mutt_strlen (this_one);")
From brief testing on Red Hat Enterprise Linux 6, the message's headers had to be viewed (via the "h" command) in order to trigger the issue.
Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708731
Created mutt tracking bugs for this issue:
Affects: fedora-all [bug 1075862]
This was fixed in the upstream 1.5.23 release: ftp://ftp.mutt.org/mutt/diff-1.5.22-1.5.23.gz
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2014:0304 https://rhn.redhat.com/errata/RHSA-2014-0304.html
This issue does not affect the version of mutt package as shipped with Red Hat Enterprise Linux 5.
mutt-1.5.23-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
mutt-1.5.23-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
mutt-1.5.23-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.