CVE-2023-4875

NameCVE-2023-4875
DescriptionNull pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3574-1, DSA-5494-1
Debian Bugs1051563

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mutt (PTS)buster1.10.1-2.1+deb10u6vulnerable
buster (security)1.10.1-2.1+deb10u7fixed
bullseye (security), bullseye2.0.5-4.1+deb11u3fixed
bookworm2.2.12-0.1~deb12u1fixed
bookworm (security)2.2.9-1+deb12u1fixed
trixie, sid2.2.12-0.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
muttsourcebuster1.10.1-2.1+deb10u7DLA-3574-1
muttsourcebullseye2.0.5-4.1+deb11u3DSA-5494-1
muttsourcebookworm2.2.9-1+deb12u1DSA-5494-1
muttsource(unstable)2.2.12-0.11051563

Notes

https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555 (mutt-2-2-12-rel)
https://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6 (mutt-2-2-12-rel)
http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html
https://www.openwall.com/lists/oss-security/2023/09/09/1

Search for package or bug name: Reporting problems