Path traversal in Mutt - CVE-2018-14362

Vulnerability identifier: #VU14148

CSH Severity: Low

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14362

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information cause DoS condition on the target system.

The vulnerability exists due to forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character. A remote attacker can conduct directory traversal attack and gain access to arbitrary data or cause the service to crash.

Mutt
Arch Linux
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
Opensuse
Fedora
mutt (Alpine package)
mutt

Update to version 1.10.1.

Mutt - update to 1.10.1
mutt (Alpine package) - update to 1.10.1-r0
mutt - addressed in versions 1.9.2-2.fc27, 1.10.1-1.fc28

• http://www.mutt.org/news.html

• Multiple vulnerabilities in Mutt
• Arch Linux update for neomutt
• OpenSUSE Linux update for mutt
• Debian update for mutt
• Red Hat update for mutt
• Gentoo update for Mutt, NeoMutt
• OpenSUSE Linux update for mutt
• Path traversal in mutt (Alpine package)
• Fedora 28 update for mutt
• Fedora 27 update for mutt