CVE-2014-9116

NONE
Published Dec 2, 201411y ago · Modified Jun 17, 20262w ago
Find Similar
Published Dec 2, 2014 11y ago
Last Modified Jun 17, 2026 2w ago

Description

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

Affected Products 5

VendorProductVersionRange
suselinux_enterprise_desktop12any
susesuse_linux_enterprise_server12any
muttmutt1.5.23any
debiandebian_linux7.0any
mageiamageia4.0any

References 13

  • advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0509.html
    Third Party Advisory
  • dev.mutt.org http://dev.mutt.org/trac/ticket/3716
    Issue TrackingVendor Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00002.html
    Third Party Advisory
  • debian.org http://www.debian.org/security/2014/dsa-3083
    Third Party Advisory
  • mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:245
    Broken Link
  • mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2015:078
    Broken Link
  • openwall.com http://www.openwall.com/lists/oss-security/2014/11/27/5
    ExploitMailing ListThird Party Advisory
  • openwall.com http://www.openwall.com/lists/oss-security/2014/11/27/9
    Mailing ListThird Party Advisory
  • securityfocus.com http://www.securityfocus.com/bid/71334
    Third Party AdvisoryVDB Entry
  • securitytracker.com http://www.securitytracker.com/id/1031266
    Third Party AdvisoryVDB Entry
  • bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125
    ExploitIssue Tracking
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1168463
    ExploitIssue Tracking
  • security.gentoo.org https://security.gentoo.org/glsa/201701-04

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.