CVE-2018-14353

CRITICAL EPSS 88.4%

Published Jul 17, 20187y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Jul 17, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

EPSS Exploit Probability

88.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

CWE-191

Vendor	Product	Version	Range
mutt	mutt	*	<1.10.1
neomutt	neomutt	*	<20180716
canonical	ubuntu_linux	14.04	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
debian	debian_linux	8.0	any
debian	debian_linux	9.0	any

mutt.org http://www.mutt.org/news.html

Release NotesVendor Advisory
github.com https://github.com/neomutt/neomutt/commit/65d64a5b60a4a3883f2cd799d92c6091d8854f23

PatchThird Party Advisory
gitlab.com https://gitlab.com/muttmua/mutt/commit/e0131852c6059107939893016c8ff56b6e42865d

PatchThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html

Mailing ListThird Party Advisory
neomutt.org https://neomutt.org/2018/07/16/release

Release NotesVendor Advisory
security.gentoo.org https://security.gentoo.org/glsa/201810-07

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/3719-1/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/3719-3/

Third Party Advisory
debian.org https://www.debian.org/security/2018/dsa-4277

Third Party Advisory

github.com https://github.com/neomutt/neomutt/commit/65d64a5b60a4a3883f2cd799d92c6091d8854f23

PatchThird Party Advisory
gitlab.com https://gitlab.com/muttmua/mutt/commit/e0131852c6059107939893016c8ff56b6e42865d

PatchThird Party Advisory