mutt: CVE-2023-4874 CVE-2023-4875

Debian Bug report logs - #1051563
mutt: CVE-2023-4874 CVE-2023-4875

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sat, 09 Sep 2023 22:23:32 +0200

Source: mutt
Version: 2.2.9-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for mutt.

CVE-2023-4874[0]:
| Null pointer dereference when viewing a specially crafted email in
| Mutt >1.5.2 <2.2.12


CVE-2023-4875[1]:
| Null pointer dereference when composing from a specially crafted
| draft message in Mutt >1.5.2 <2.2.12

Make sure to include all three commits referenced from [2], the last
one is technically not part of the two CVEs, but another crash found
by upstream.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-4874
    https://www.cve.org/CVERecord?id=CVE-2023-4874
[1] https://security-tracker.debian.org/tracker/CVE-2023-4875
    https://www.cve.org/CVERecord?id=CVE-2023-4875
[2] http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antonio Radici <antonio@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1051563@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 13:05:31 +0200

On Sat, Sep 09, 2023 at 10:23:32PM +0200, Salvatore Bonaccorso wrote:
> Source: mutt
> Version: 2.2.9-1
> Severity: grave
> Tags: security upstream
> Justification: user security hole
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> 
> Hi,
> 
> The following vulnerabilities were published for mutt.
> 
> CVE-2023-4874[0]:
> | Null pointer dereference when viewing a specially crafted email in
> | Mutt >1.5.2 <2.2.12
> 
> 
> CVE-2023-4875[1]:
> | Null pointer dereference when composing from a specially crafted
> | draft message in Mutt >1.5.2 <2.2.12
> 
> Make sure to include all three commits referenced from [2], the last
> one is technically not part of the two CVEs, but another crash found
> by upstream.
> 
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2023-4874
>     https://www.cve.org/CVERecord?id=CVE-2023-4874
> [1] https://security-tracker.debian.org/tracker/CVE-2023-4875
>     https://www.cve.org/CVERecord?id=CVE-2023-4875
> [2] http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html
> 
> Please adjust the affected versions in the BTS as needed.

Thanks for raising this, I'm uploading the new packages with the fixes today.

Message #20 received at 1051563-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1051563-close@bugs.debian.org

Subject: Bug#1051563: fixed in mutt 2.2.12-0.1

Date: Sun, 10 Sep 2023 11:12:35 +0000

Source: mutt
Source-Version: 2.2.12-0.1
Done: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

We believe that the bug you reported is fixed in the latest version of
mutt, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1051563@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Andrzej Siewior <sebastian@breakpoint.cc> (supplier of updated mutt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 10 Sep 2023 12:21:34 +0200
Source: mutt
Architecture: source
Version: 2.2.12-0.1
Distribution: unstable
Urgency: medium
Maintainer: Mutt maintainers <mutt@packages.debian.org>
Changed-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Closes: 1051563
Changes:
 mutt (2.2.12-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release (Closes: #1051563).
     - CVE-2023-4874 ("Null pointer dereference when viewing a specially
       crafted email).
     - CVE-2023-4875 ("Null pointer dereference when composing from a specially
       crafted draft message").
Checksums-Sha1:
 bcd3a53f911d60b905c73c4b5041e7c7cc8c4720 2122 mutt_2.2.12-0.1.dsc
 11107acfd21617a3a063a9ee16f21aedc8b8594f 5539244 mutt_2.2.12.orig.tar.gz
 59b657d0ad60c19e5cf6eb9d86aa812afd481f35 833 mutt_2.2.12.orig.tar.gz.asc
 18994ae51d1f04b365542ba3853643494fc2caea 61952 mutt_2.2.12-0.1.debian.tar.xz
Checksums-Sha256:
 38136ad23ab01826aa6a926f21eadeea083ce18e7a2a78261ebf4ab55d42cf24 2122 mutt_2.2.12-0.1.dsc
 043af312f64b8e56f7fd0bf77f84a205d4c498030bd9586457665c47bb18ce38 5539244 mutt_2.2.12.orig.tar.gz
 4fdbbb4369d8f1ee55937feaf1d3f090867b05a1e646b036f830171ce238db84 833 mutt_2.2.12.orig.tar.gz.asc
 7704b58ab675d9a48a676e9974c9ec725ffa6ff90372877a5f9510d8bf05adb3 61952 mutt_2.2.12-0.1.debian.tar.xz
Files:
 5262930f62024cec1f2ac3591062a45d 2122 mail optional mutt_2.2.12-0.1.dsc
 5b3e1feb8473bf64847d1fd85084dbb0 5539244 mail optional mutt_2.2.12.orig.tar.gz
 5c8d450ebe83630b4646c5fbc2540ada 833 mail optional mutt_2.2.12.orig.tar.gz.asc
 2e7b897574f0b27479069d68656d3673 61952 mail optional mutt_2.2.12-0.1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmT9nVoACgkQBWQfF1cS
+lvLmAv/QmUYSLvKdigxnhk2a42hHQHN248IOo/TkFB3CdW5QhEWRyVSS1xeI1WS
V6quplmZU/KWbC9jWm2VE58hJO3oZayv2dje/Soxahmp1D/cr5cqLiBOIbDilVdD
OdzzZqzbR/c4M47w/atNhKzr6s8ldyjkrL/4kzJvK9yw8si7/ko/ByYAIWztE+aB
2m5ktkqIOSWl9o1pSY3fhbrP0RxWhG+PdjHIYyQU14ezoEkWl5NsYp/DBeooKf7O
O3i5ZOA/t2S4p3zoIzmCjhZF84GTq3zr/AcCAe38GBBGMAlwi9QJhLaLPfnI43go
KTssOar1huSubzLXY+LWWDjurGMAxw7dLINOqs4FoIFHq/GA91adI/RZpXkoKvc/
/7BM3ItqdMgBdl03MNpziaU2V7xakQZeMBkfLX9Mr8LIvlIiPzOIA8iOZN2wxk5t
IkDSLLrvI9qQif26c0sYZffDRWLganCjRoUoSoLwjnOclKm97VzpUqpw6ZPanezm
UKVf3XyR
=j6Q9
-----END PGP SIGNATURE-----

Message #25 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antonio Radici <antonio@debian.org>

To: 1051563@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>, Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 13:24:10 +0200

On Sun, Sep 10, 2023 at 01:05:31PM +0200, Antonio Radici wrote:
> Thanks for raising this, I'm uploading the new packages with the fixes today.

apparently someone else did a NMU with the new version and incorrectly closed
the bug.

I reopened the bug because stable needs to be addressed (which I will do today
as I just wrote) and then it's probably worth investigating how to integrate
those NMU into the git repo

Message #39 received at 1051563@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Antonio Radici <antonio@debian.org>, 1051563@bugs.debian.org

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 13:38:33 +0200

Hi Antonio,

On Sun, Sep 10, 2023 at 01:05:31PM +0200, Antonio Radici wrote:
> On Sat, Sep 09, 2023 at 10:23:32PM +0200, Salvatore Bonaccorso wrote:
> > Source: mutt
> > Version: 2.2.9-1
> > Severity: grave
> > Tags: security upstream
> > Justification: user security hole
> > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> > 
> > Hi,
> > 
> > The following vulnerabilities were published for mutt.
> > 
> > CVE-2023-4874[0]:
> > | Null pointer dereference when viewing a specially crafted email in
> > | Mutt >1.5.2 <2.2.12
> > 
> > 
> > CVE-2023-4875[1]:
> > | Null pointer dereference when composing from a specially crafted
> > | draft message in Mutt >1.5.2 <2.2.12
> > 
> > Make sure to include all three commits referenced from [2], the last
> > one is technically not part of the two CVEs, but another crash found
> > by upstream.
> > 
> > If you fix the vulnerabilities please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
> > 
> > For further information see:
> > 
> > [0] https://security-tracker.debian.org/tracker/CVE-2023-4874
> >     https://www.cve.org/CVERecord?id=CVE-2023-4874
> > [1] https://security-tracker.debian.org/tracker/CVE-2023-4875
> >     https://www.cve.org/CVERecord?id=CVE-2023-4875
> > [2] http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html
> > 
> > Please adjust the affected versions in the BTS as needed.
> 
> Thanks for raising this, I'm uploading the new packages with the fixes today.

FWIW, I have done the bookworm-security upload already to
security-master, and still working on the bullseye-security one (with
plan to release the DSA tonight ideally).

Regards,
Salvatore

Message #44 received at 1051563@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Antonio Radici <antonio@debian.org>, 1051563@bugs.debian.org

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 13:47:30 +0200

Hi Antonio,

On Sun, Sep 10, 2023 at 01:24:10PM +0200, Antonio Radici wrote:
> On Sun, Sep 10, 2023 at 01:05:31PM +0200, Antonio Radici wrote:
> > Thanks for raising this, I'm uploading the new packages with the fixes today.
> 
> apparently someone else did a NMU with the new version and incorrectly closed
> the bug.

You mean the NMU by Sebastian?

> I reopened the bug because stable needs to be addressed (which I will do today
> as I just wrote) and then it's probably worth investigating how to integrate
> those NMU into the git repo

Actually you do not need to reopen. A bug can be closed with mutliple
versions, that is 2.2.12-0.1 closes it, but as well so does then the
2.2.9-1+deb12u1 upload and the 2.0.5-4.1+deb11u3 one.

I think that was not the case several years ago, but nowdays BTS can
handle that, and will reflect it nicely as well in the version graph.

Or were you meaning something different?

Regards,
Salvatore

Message #49 received at 1051563@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 1051563@bugs.debian.org

Cc: Antonio Radici <antonio@debian.org>

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 14:21:16 +0200

[Message part 1 (text/plain, inline)]

Hi,

On Sun, Sep 10, 2023 at 01:38:33PM +0200, Salvatore Bonaccorso wrote:
> Hi Antonio,
> 
> On Sun, Sep 10, 2023 at 01:05:31PM +0200, Antonio Radici wrote:
> > On Sat, Sep 09, 2023 at 10:23:32PM +0200, Salvatore Bonaccorso wrote:
> > > Source: mutt
> > > Version: 2.2.9-1
> > > Severity: grave
> > > Tags: security upstream
> > > Justification: user security hole
> > > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> > > 
> > > Hi,
> > > 
> > > The following vulnerabilities were published for mutt.
> > > 
> > > CVE-2023-4874[0]:
> > > | Null pointer dereference when viewing a specially crafted email in
> > > | Mutt >1.5.2 <2.2.12
> > > 
> > > 
> > > CVE-2023-4875[1]:
> > > | Null pointer dereference when composing from a specially crafted
> > > | draft message in Mutt >1.5.2 <2.2.12
> > > 
> > > Make sure to include all three commits referenced from [2], the last
> > > one is technically not part of the two CVEs, but another crash found
> > > by upstream.
> > > 
> > > If you fix the vulnerabilities please also make sure to include the
> > > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
> > > 
> > > For further information see:
> > > 
> > > [0] https://security-tracker.debian.org/tracker/CVE-2023-4874
> > >     https://www.cve.org/CVERecord?id=CVE-2023-4874
> > > [1] https://security-tracker.debian.org/tracker/CVE-2023-4875
> > >     https://www.cve.org/CVERecord?id=CVE-2023-4875
> > > [2] http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html
> > > 
> > > Please adjust the affected versions in the BTS as needed.
> > 
> > Thanks for raising this, I'm uploading the new packages with the fixes today.
> 
> FWIW, I have done the bookworm-security upload already to
> security-master, and still working on the bullseye-security one (with
> plan to release the DSA tonight ideally).

Here are the debdiffs for those.

Regards,
Salvatore

[mutt_2.0.5-4.1+deb11u3.debdiff (text/plain, attachment)]

[mutt_2.2.9-1+deb12u1.debdiff (text/plain, attachment)]

Message #58 received at 1051563@bugs.debian.org (full text, mbox, reply):

From: Antonio Radici <antonio@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1051563@bugs.debian.org

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 15:57:13 +0200

On Sun, Sep 10, 2023 at 01:47:30PM +0200, Salvatore Bonaccorso wrote:
> Hi Antonio,
> 
> On Sun, Sep 10, 2023 at 01:24:10PM +0200, Antonio Radici wrote:
> > On Sun, Sep 10, 2023 at 01:05:31PM +0200, Antonio Radici wrote:
> > > Thanks for raising this, I'm uploading the new packages with the fixes today.
> > 
> > apparently someone else did a NMU with the new version and incorrectly closed
> > the bug.
> 
> You mean the NMU by Sebastian?

Yes

> 
> > I reopened the bug because stable needs to be addressed (which I will do today
> > as I just wrote) and then it's probably worth investigating how to integrate
> > those NMU into the git repo
> 
> Actually you do not need to reopen. A bug can be closed with mutliple
> versions, that is 2.2.12-0.1 closes it, but as well so does then the
> 2.2.9-1+deb12u1 upload and the 2.0.5-4.1+deb11u3 one.
> 
> I think that was not the case several years ago, but nowdays BTS can
> handle that, and will reflect it nicely as well in the version graph.
> 
> Or were you meaning something different?

Ah ok good, then I will add the extra versions if they are not there already

Message #63 received at 1051563@bugs.debian.org (full text, mbox, reply):

From: Antonio Radici <antonio@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 1051563@bugs.debian.org

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 15:57:58 +0200

On Sun, Sep 10, 2023 at 01:38:33PM +0200, Salvatore Bonaccorso wrote:
> Hi Antonio,
> 
> FWIW, I have done the bookworm-security upload already to
> security-master, and still working on the bullseye-security one (with
> plan to release the DSA tonight ideally).

Ack, thanks for the update, I assume this was a particularly serious issue that
had to be handled immediately!

Message #68 received at 1051563@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Antonio Radici <antonio@debian.org>

Cc: 1051563@bugs.debian.org

Subject: Re: Bug#1051563: mutt: CVE-2023-4874 CVE-2023-4875

Date: Sun, 10 Sep 2023 18:03:04 +0200

Hi Antonio,

On Sun, Sep 10, 2023 at 03:57:58PM +0200, Antonio Radici wrote:
> On Sun, Sep 10, 2023 at 01:38:33PM +0200, Salvatore Bonaccorso wrote:
> > Hi Antonio,
> > 
> > FWIW, I have done the bookworm-security upload already to
> > security-master, and still working on the bullseye-security one (with
> > plan to release the DSA tonight ideally).
> 
> Ack, thanks for the update, I assume this was a particularly serious issue that
> had to be handled immediately!

In retrospect, I'm not completely sure, but better to be on the safe
side in this case. The NULL pointer dereference flaw reported by
Chenyuan Mi is one when composing from a specially crafted draft
message, so rather on the harmless side, but the second is when
viewing a message with specially crafted headers, leading to a crash.
OTOH it is isolated to such an email, when viewing a message with
specially crafted headers, see the commit
https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0
in particular.

I agree that maybe I should have waited for you for comments, which I
try to remember to keep in mind for any future occurence.

Regards,
Salvatore

Send a report that this bug log contains spam.