Path traversal in Mutt - CVE-2018-14363
Published: July 31, 2018
Vulnerability identifier: #VU14149
CSH Severity: Low
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-14363
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information cause DoS condition on the target system.
The vulnerability exists due to newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames. A remote attacker can conduct directory traversal attack and gain access to arbitrary data or cause the service to crash.
Affected software
Mutt
Arch Linux
Debian Linux
Opensuse
Arch Linux
Debian Linux
Opensuse
How to mitigate CVE-2018-14363
Update to version 1.10.1.
Mutt - update to 1.10.1