UbuntuUpdates.org

Package "mutt"

Name: mutt

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Mutt Mail User Agent with extra patches
Latest version: 1.5.24-1ubuntu0.6
Release: xenial (16.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "mutt" in Xenial

Repository Area Version
base universe 1.5.24-1build1
base main 1.5.24-1build1
security main 1.5.24-1ubuntu0.6
updates universe 1.5.24-1ubuntu0.6
updates main 1.5.24-1ubuntu0.6

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.5.24-1ubuntu0.6 2021-01-25 16:06:17 UTC

  mutt (1.5.24-1ubuntu0.6) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2021-3181-1.patch: Fix memory leak parsing group addresses without a display name
      in rfc822.c.
    - debian/patches/CVE-2021-3181-2.patch: Don't allocate a group terminator unless we are in a group-list
      in rfc822.c.
    - debian/patches/CVE-2021-3181-3.patch: Add group terminator if it is left
      off in rfc822.c.
    - CVE-2021-3181

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 21 Jan 2021 13:14:31 -0300
Source diff to previous version
CVE-2021-3181 rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences

Version: 1.5.24-1ubuntu0.5 2020-11-25 16:07:25 UTC

  mutt (1.5.24-1ubuntu0.5) xenial-security; urgency=medium

  * SECURITY UPDATE: Sensitive information exposed
    - debian/patches/CVE-2020-28896.patch: Ensure IMAP connection is closed
      after a connection error in imap/imap.c.
    - CVE-2020-28896

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 24 Nov 2020 10:51:05 -0300
Source diff to previous version
CVE-2020-28896 Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was inva

Version: 1.5.24-1ubuntu0.4 2020-06-24 18:07:04 UTC

  mutt (1.5.24-1ubuntu0.4) xenial-security; urgency=medium

  * SECURITY UPDATE: Man-in-the-middle attack
    - debian/patches/CVE-2020-14954.patch: fix STARTTLS response injection
      attack clearing the CONNECTION input buffer in mutt_ssl_starttls() in
      mutt_socket.c, mutt_socket.h, mutt_ssl.c, mutt_ssl_gnutls.c.
    - CVE-2020-14954
  * Redoing patch CVE-2020-14154-1, that causes a possibly regression (LP: #1884588)

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 22 Jun 2020 17:26:12 -0300
Source diff to previous version
1884588 Certificate problems sending mail
CVE-2020-14954 Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS"
CVE-2020-14154 Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certifica

Version: 1.5.24-1ubuntu0.3 2020-06-22 16:06:32 UTC

  mutt (1.5.24-1ubuntu0.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Man-in-the-middle attack
    - debian/patches/CVE-2020-14093.patch: prevent
      possible IMAP MITM via PREAUTH response in imap/imap.c.
    - CVE-2020-14093
  * SECURITY UPDATE: Connection even if the user rejects an
    expired intermediate certificate
    - debian/patches/CVE-2020-14154-1.patch: fix GnuTLS tls_verify_peers()
      checking in mutt_ssl_gnutls.c.
    - debian/patches/CVE-2020-14154-2.patch: Abort GnuTLS certificate if a
      cert in the chain is rejected in mutt_ssl_gnutls.c.
    - debian/patches/CVE-2020-14154-3.patch: fix GnuTLS interactive prompt
      short-circuiting in mutt_ssl_gnutls.c.
    - CVE-2020-14154

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 18 Jun 2020 10:02:48 -0300
Source diff to previous version
CVE-2020-14093 Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
CVE-2020-14154 Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certifica

Version: 1.5.24-1ubuntu0.2 2018-09-28 01:06:44 UTC

  mutt (1.5.24-1ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: apply all fixes to both mutt and mutt-patched
    - debian/patches/series: re-order patch application (LP: #1794278)

 -- Steve Beattie <email address hidden> Wed, 26 Sep 2018 12:43:56 -0700
1794278 Security patches not applied to xenial mutt


About   -   Send Feedback to @ubuntu_updates