Vulnerability from csaf_suse
Published
2018-07-27 10:45
Modified
2018-07-27 10:45
Summary
Security update for mutt
Notes
Title of the patch
Security update for mutt
Description of the patch
This update for mutt fixes the following issues:
Security issues fixed:
- bsc#1101428: Mutt 1.10.1 security release update.
- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).
- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).
- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).
- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).
- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).
- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).
- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).
- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).
- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).
- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).
- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).
- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).
- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).
- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).
- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).
Bug fixes:
- mutt reports as neomutt and incorrect version (bsc#1094717)
- No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)
- mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)
- (neo)mutt displaying times in Zulu time (bsc#1061343)
- mutt unconditionally segfaults when displaying a message (bsc#986534)
Patchnames
SUSE-SLE-DESKTOP-12-SP3-2018-1415,SUSE-SLE-SERVER-12-SP3-2018-1415
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for mutt", title: "Title of the patch", }, { category: "description", text: "This update for mutt fixes the following issues:\n\nSecurity issues fixed:\n\n- bsc#1101428: Mutt 1.10.1 security release update.\n- CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583).\n- CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581).\n- CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567).\n- CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578).\n- CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582).\n- CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576).\n- CVE-2018-14355: Fix imap/util.c that mishandles '..' directory traversal in a mailbox name (bsc#1101577).\n- CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589).\n- CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588).\n- CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566).\n- CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570).\n- CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571).\n- CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569).\n- CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573).\n- CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568).\n\nBug fixes:\n\n- mutt reports as neomutt and incorrect version (bsc#1094717)\n- No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830)\n- mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129)\n- (neo)mutt displaying times in Zulu time (bsc#1061343)\n- mutt unconditionally segfaults when displaying a message (bsc#986534)\n", title: "Description of the patch", }, { category: "details", text: "SUSE-SLE-DESKTOP-12-SP3-2018-1415,SUSE-SLE-SERVER-12-SP3-2018-1415", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_2084-1.json", }, { category: "self", summary: "URL for SUSE-SU-2018:2084-1", url: "https://www.suse.com/support/update/announcement/2018/suse-su-20182084-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2018:2084-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2018-July/004326.html", }, { category: "self", summary: "SUSE Bug 1061343", url: "https://bugzilla.suse.com/1061343", }, { category: "self", summary: "SUSE Bug 1094717", url: "https://bugzilla.suse.com/1094717", }, { category: "self", summary: "SUSE Bug 1101428", url: "https://bugzilla.suse.com/1101428", }, { category: "self", summary: "SUSE Bug 1101566", url: "https://bugzilla.suse.com/1101566", }, { category: "self", summary: "SUSE Bug 1101567", url: "https://bugzilla.suse.com/1101567", }, { category: "self", summary: "SUSE Bug 1101568", url: "https://bugzilla.suse.com/1101568", }, { category: "self", summary: "SUSE Bug 1101569", url: "https://bugzilla.suse.com/1101569", }, { category: "self", summary: "SUSE Bug 1101570", url: "https://bugzilla.suse.com/1101570", }, { category: "self", summary: "SUSE Bug 1101571", url: "https://bugzilla.suse.com/1101571", }, { category: "self", summary: "SUSE Bug 1101573", url: "https://bugzilla.suse.com/1101573", }, { category: "self", summary: "SUSE Bug 1101576", url: "https://bugzilla.suse.com/1101576", }, { category: "self", summary: "SUSE Bug 1101577", url: "https://bugzilla.suse.com/1101577", }, { category: "self", summary: "SUSE Bug 1101578", url: "https://bugzilla.suse.com/1101578", }, { category: "self", summary: "SUSE Bug 1101581", url: "https://bugzilla.suse.com/1101581", }, { category: "self", summary: "SUSE Bug 1101582", url: "https://bugzilla.suse.com/1101582", }, { category: "self", summary: "SUSE Bug 1101583", url: "https://bugzilla.suse.com/1101583", }, { category: "self", summary: "SUSE Bug 1101588", url: "https://bugzilla.suse.com/1101588", }, { category: "self", summary: "SUSE Bug 1101589", url: "https://bugzilla.suse.com/1101589", }, { category: "self", summary: "SUSE Bug 980830", url: "https://bugzilla.suse.com/980830", }, { category: "self", summary: "SUSE Bug 982129", url: "https://bugzilla.suse.com/982129", }, { category: "self", summary: "SUSE Bug 986534", url: "https://bugzilla.suse.com/986534", }, { category: "self", summary: "SUSE CVE CVE-2014-9116 page", url: "https://www.suse.com/security/cve/CVE-2014-9116/", }, { category: "self", summary: "SUSE CVE CVE-2018-14349 page", url: "https://www.suse.com/security/cve/CVE-2018-14349/", }, { category: "self", summary: "SUSE CVE CVE-2018-14350 page", url: "https://www.suse.com/security/cve/CVE-2018-14350/", }, { category: "self", summary: "SUSE CVE CVE-2018-14351 page", url: "https://www.suse.com/security/cve/CVE-2018-14351/", }, { category: "self", summary: "SUSE CVE CVE-2018-14352 page", url: "https://www.suse.com/security/cve/CVE-2018-14352/", }, { category: "self", summary: "SUSE CVE CVE-2018-14353 page", url: "https://www.suse.com/security/cve/CVE-2018-14353/", }, { category: "self", summary: "SUSE CVE CVE-2018-14354 page", url: "https://www.suse.com/security/cve/CVE-2018-14354/", }, { category: "self", summary: "SUSE CVE CVE-2018-14355 page", url: "https://www.suse.com/security/cve/CVE-2018-14355/", }, { category: "self", summary: "SUSE CVE CVE-2018-14356 page", url: "https://www.suse.com/security/cve/CVE-2018-14356/", }, { category: "self", summary: "SUSE CVE CVE-2018-14357 page", url: "https://www.suse.com/security/cve/CVE-2018-14357/", }, { category: "self", summary: "SUSE CVE CVE-2018-14358 page", url: "https://www.suse.com/security/cve/CVE-2018-14358/", }, { category: "self", summary: "SUSE CVE CVE-2018-14359 page", url: "https://www.suse.com/security/cve/CVE-2018-14359/", }, { category: "self", summary: "SUSE CVE CVE-2018-14360 page", url: "https://www.suse.com/security/cve/CVE-2018-14360/", }, { category: "self", summary: "SUSE CVE CVE-2018-14361 page", url: "https://www.suse.com/security/cve/CVE-2018-14361/", }, { category: "self", summary: "SUSE CVE CVE-2018-14362 page", url: "https://www.suse.com/security/cve/CVE-2018-14362/", }, { category: "self", summary: "SUSE CVE CVE-2018-14363 page", url: "https://www.suse.com/security/cve/CVE-2018-14363/", }, ], title: "Security update for mutt", tracking: { current_release_date: "2018-07-27T10:45:47Z", generator: { date: "2018-07-27T10:45:47Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2018:2084-1", initial_release_date: "2018-07-27T10:45:47Z", revision_history: [ { date: "2018-07-27T10:45:47Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "mutt-1.10.1-55.3.1.aarch64", product: { name: "mutt-1.10.1-55.3.1.aarch64", product_id: "mutt-1.10.1-55.3.1.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "mutt-1.10.1-55.3.1.ppc64le", product: { name: "mutt-1.10.1-55.3.1.ppc64le", product_id: "mutt-1.10.1-55.3.1.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "mutt-1.10.1-55.3.1.s390x", product: { name: "mutt-1.10.1-55.3.1.s390x", product_id: "mutt-1.10.1-55.3.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "mutt-1.10.1-55.3.1.x86_64", product: { name: "mutt-1.10.1-55.3.1.x86_64", product_id: "mutt-1.10.1-55.3.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Desktop 12 SP3", product: { name: "SUSE Linux Enterprise Desktop 12 SP3", product_id: "SUSE Linux Enterprise Desktop 12 SP3", product_identification_helper: { cpe: "cpe:/o:suse:sled:12:sp3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server 12 SP3", product: { name: "SUSE Linux Enterprise Server 12 SP3", product_id: "SUSE Linux Enterprise Server 12 SP3", product_identification_helper: { cpe: "cpe:/o:suse:sles:12:sp3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", product: { name: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:12:sp3", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP3", product_id: "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", }, product_reference: "mutt-1.10.1-55.3.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Desktop 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3", product_id: "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", }, product_reference: "mutt-1.10.1-55.3.1.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3", product_id: "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", }, product_reference: "mutt-1.10.1-55.3.1.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.s390x as component of SUSE Linux Enterprise Server 12 SP3", product_id: "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", }, product_reference: "mutt-1.10.1-55.3.1.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3", product_id: "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", }, product_reference: "mutt-1.10.1-55.3.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", }, product_reference: "mutt-1.10.1-55.3.1.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", }, product_reference: "mutt-1.10.1-55.3.1.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", }, product_reference: "mutt-1.10.1-55.3.1.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", }, { category: "default_component_of", full_product_name: { name: "mutt-1.10.1-55.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", }, product_reference: "mutt-1.10.1-55.3.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3", }, ], }, vulnerabilities: [ { cve: "CVE-2014-9116", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-9116", }, ], notes: [ { category: "general", text: "The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-9116", url: "https://www.suse.com/security/cve/CVE-2014-9116", }, { category: "external", summary: "SUSE Bug 907453 for CVE-2014-9116", url: "https://bugzilla.suse.com/907453", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2014-9116", }, { cve: "CVE-2018-14349", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14349", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14349", url: "https://www.suse.com/security/cve/CVE-2018-14349", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14349", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101589 for CVE-2018-14349", url: "https://bugzilla.suse.com/1101589", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14349", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14349", }, { cve: "CVE-2018-14350", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14350", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14350", url: "https://www.suse.com/security/cve/CVE-2018-14350", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14350", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101588 for CVE-2018-14350", url: "https://bugzilla.suse.com/1101588", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14350", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14350", }, { cve: "CVE-2018-14351", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14351", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14351", url: "https://www.suse.com/security/cve/CVE-2018-14351", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14351", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101583 for CVE-2018-14351", url: "https://bugzilla.suse.com/1101583", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14351", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.3, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "important", }, ], title: "CVE-2018-14351", }, { cve: "CVE-2018-14352", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14352", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14352", url: "https://www.suse.com/security/cve/CVE-2018-14352", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14352", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101582 for CVE-2018-14352", url: "https://bugzilla.suse.com/1101582", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14352", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14352", }, { cve: "CVE-2018-14353", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14353", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14353", url: "https://www.suse.com/security/cve/CVE-2018-14353", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14353", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101581 for CVE-2018-14353", url: "https://bugzilla.suse.com/1101581", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14353", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14353", }, { cve: "CVE-2018-14354", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14354", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14354", url: "https://www.suse.com/security/cve/CVE-2018-14354", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14354", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101578 for CVE-2018-14354", url: "https://bugzilla.suse.com/1101578", }, { category: "external", summary: "SUSE Bug 1101581 for CVE-2018-14354", url: "https://bugzilla.suse.com/1101581", }, { category: "external", summary: "SUSE Bug 1101589 for CVE-2018-14354", url: "https://bugzilla.suse.com/1101589", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14354", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.6, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "critical", }, ], title: "CVE-2018-14354", }, { cve: "CVE-2018-14355", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14355", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles \"..\" directory traversal in a mailbox name.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14355", url: "https://www.suse.com/security/cve/CVE-2018-14355", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14355", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101577 for CVE-2018-14355", url: "https://bugzilla.suse.com/1101577", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14355", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14355", }, { cve: "CVE-2018-14356", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14356", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14356", url: "https://www.suse.com/security/cve/CVE-2018-14356", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14356", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101576 for CVE-2018-14356", url: "https://bugzilla.suse.com/1101576", }, { category: "external", summary: "SUSE Bug 1101589 for CVE-2018-14356", url: "https://bugzilla.suse.com/1101589", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14356", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14356", }, { cve: "CVE-2018-14357", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14357", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14357", url: "https://www.suse.com/security/cve/CVE-2018-14357", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14357", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101573 for CVE-2018-14357", url: "https://bugzilla.suse.com/1101573", }, { category: "external", summary: "SUSE Bug 1101581 for CVE-2018-14357", url: "https://bugzilla.suse.com/1101581", }, { category: "external", summary: "SUSE Bug 1101589 for CVE-2018-14357", url: "https://bugzilla.suse.com/1101589", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14357", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "important", }, ], title: "CVE-2018-14357", }, { cve: "CVE-2018-14358", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14358", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14358", url: "https://www.suse.com/security/cve/CVE-2018-14358", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14358", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101571 for CVE-2018-14358", url: "https://bugzilla.suse.com/1101571", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14358", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14358", }, { cve: "CVE-2018-14359", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14359", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14359", url: "https://www.suse.com/security/cve/CVE-2018-14359", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14359", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101570 for CVE-2018-14359", url: "https://bugzilla.suse.com/1101570", }, { category: "external", summary: "SUSE Bug 1101589 for CVE-2018-14359", url: "https://bugzilla.suse.com/1101589", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14359", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14359", }, { cve: "CVE-2018-14360", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14360", }, ], notes: [ { category: "general", text: "An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14360", url: "https://www.suse.com/security/cve/CVE-2018-14360", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14360", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101569 for CVE-2018-14360", url: "https://bugzilla.suse.com/1101569", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14360", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "critical", }, ], title: "CVE-2018-14360", }, { cve: "CVE-2018-14361", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14361", }, ], notes: [ { category: "general", text: "An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14361", url: "https://www.suse.com/security/cve/CVE-2018-14361", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14361", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101568 for CVE-2018-14361", url: "https://bugzilla.suse.com/1101568", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14361", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "critical", }, ], title: "CVE-2018-14361", }, { cve: "CVE-2018-14362", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14362", }, ], notes: [ { category: "general", text: "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14362", url: "https://www.suse.com/security/cve/CVE-2018-14362", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14362", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101567 for CVE-2018-14362", url: "https://bugzilla.suse.com/1101567", }, { category: "external", summary: "SUSE Bug 1101589 for CVE-2018-14362", url: "https://bugzilla.suse.com/1101589", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14362", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "moderate", }, ], title: "CVE-2018-14362", }, { cve: "CVE-2018-14363", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-14363", }, ], notes: [ { category: "general", text: "An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-14363", url: "https://www.suse.com/security/cve/CVE-2018-14363", }, { category: "external", summary: "SUSE Bug 1101428 for CVE-2018-14363", url: "https://bugzilla.suse.com/1101428", }, { category: "external", summary: "SUSE Bug 1101566 for CVE-2018-14363", url: "https://bugzilla.suse.com/1101566", }, { category: "external", summary: "SUSE Bug 1101593 for CVE-2018-14363", url: "https://bugzilla.suse.com/1101593", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Desktop 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server 12 SP3:mutt-1.10.1-55.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.3.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2018-07-27T10:45:47Z", details: "important", }, ], title: "CVE-2018-14363", }, ], }
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.