GNU bug report logs - #32373
neomutt 20180716 security update (fixes CVE-2018-14349 - CVE-2018-14363)

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Nils Gillmann <ng0 <at> n0.is>
Subject: bug#32373: closed (Re: [bug#32373] neomutt 20180716 security
 update (fixes CVE-2018-14349 - CVE-2018-14363))
Date: Mon, 06 Aug 2018 10:12:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#32373: neomutt 20180716 security update (fixes CVE-2018-14349 - CVE-2018-14363)

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 32373 <at> debbugs.gnu.org.

-- 
32373: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=32373
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Efraim Flashner <efraim <at> flashner.co.il>
To: 32373-done <at> debbugs.gnu.org
Subject: Re: [bug#32373] neomutt 20180716 security update (fixes
 CVE-2018-14349 - CVE-2018-14363)
Date: Mon, 6 Aug 2018 13:11:28 +0300

[Message part 3 (text/plain, inline)]

Applied as 46add5615a49c0fbd125296be8a114b04a03412c

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

[Message part 5 (message/rfc822, inline)]

From: Nils Gillmann <ng0 <at> n0.is>
To: guix-patches <at> gnu.org
Subject: neomutt 20180716 security update (fixes CVE-2018-14349 -
 CVE-2018-14363)
Date: Mon, 6 Aug 2018 09:29:10 +0000

[Message part 6 (text/plain, inline)]

Hi,

sorry for being late on this important update, life kept me busy.

From the release notes:

> Notes
> This is a small, but intensive, bug-fix release.
> It fixes some important security holes, so upgrading is strongly recommended.
> Some large architectural changes are coming, so the next release may be some months away.
>
> Security
> CVE-2018-14349 - NO Response Heap Overflow
> CVE-2018-14350 - INTERNALDATE Stack Overflow
> CVE-2018-14351 - STATUS Literal Length relative write
> CVE-2018-14352 - imap_quote_string off-by-one stack overflow
> CVE-2018-14353 - imap_quote_string int underflow
> CVE-2018-14354 - imap_subscribe Remote Code Execution
> CVE-2018-14355 - STATUS mailbox header cache directory traversal
> CVE-2018-14356 - POP empty UID NULL deref
> CVE-2018-14357 - LSUB Remote Code Execution
> CVE-2018-14358 - RFC822.SIZE Stack Overflow
> CVE-2018-14359 - base64 decode Stack Overflow
> CVE-2018-14360 - NNTP Group Stack Overflow
> CVE-2018-14361 - NNTP Write 1 where via GROUP response
> CVE-2018-14362 - POP Message Cache Directory Traversal
> CVE-2018-14363 - NNTP Header Cache Directory Traversal

[0001-gnu-neomutt-Update-to-20180716-fixes-CVE-2018-14349-.patch (text/plain, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.