An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription. References: http://www.mutt.org/news.html Upstream Patch: https://gitlab.com/muttmua/mutt/commit/185152818541f5cdc059cbff3f3e8b654fc27c1d https://github.com/neomutt/neomutt/commit/e52393740334443ae0206cab2d7caef381646725
Created mutt tracking bugs for this issue: Affects: fedora-all [bug 1602916]
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2018:2526 https://access.redhat.com/errata/RHSA-2018:2526