CVE-2018-14351

CRITICAL EPSS 86.4%

Published Jul 17, 20187y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Jul 17, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

EPSS Exploit Probability

86.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

CWE-20 Improper Input Validation Validation

Vendor	Product	Version	Range
mutt	mutt	*	<1.10.1
neomutt	neomutt	*	<20180716
canonical	ubuntu_linux	16.04	any
debian	debian_linux	8.0	any
debian	debian_linux	9.0	any

mutt.org http://www.mutt.org/news.html

Release NotesVendor Advisory
github.com https://github.com/neomutt/neomutt/commit/3c49c44be9b459d9c616bcaef6eb5d51298c1741

PatchThird Party Advisory
gitlab.com https://gitlab.com/muttmua/mutt/commit/e57a8602b45f58edf7b3ffb61bb17525d75dfcb1

PatchThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html

Mailing ListThird Party Advisory
neomutt.org https://neomutt.org/2018/07/16/release

Release NotesVendor Advisory
security.gentoo.org https://security.gentoo.org/glsa/201810-07

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/3719-3/

Third Party Advisory
debian.org https://www.debian.org/security/2018/dsa-4277

Third Party Advisory

github.com https://github.com/neomutt/neomutt/commit/3c49c44be9b459d9c616bcaef6eb5d51298c1741

PatchThird Party Advisory
gitlab.com https://gitlab.com/muttmua/mutt/commit/e57a8602b45f58edf7b3ffb61bb17525d75dfcb1

PatchThird Party Advisory