CVE-2007-2683: Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code

Related Vulnerabilities: CVE-2007-2683  

Debian Bug report logs - #426116
CVE-2007-2683: Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code

version graph

Package: mutt; Maintainer for mutt is Mutt maintainers <mutt@packages.debian.org>; Source for mutt is src:mutt (PTS, buildd, popcon).

Reported by: Stefan Fritsch <sf@sfritsch.de>

Date: Sat, 26 May 2007 12:06:01 UTC

Severity: important

Tags: fixed-upstream, security

Found in versions mutt/1.5.13-3, mutt/1.5.13-1.1, 1.5.9-2sarge2, mutt/1.5.9-2sarge1

Fixed in version mutt/1.5.15+20070608-1

Done: Christoph Berg <myon@debian.org>

Bug is archived. No further changes may be made.

Forwarded to http://bugs.mutt.org/2885

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, Adeodato Simó <dato@net.com.org.es>:
Bug#426116; Package mutt. (full text, mbox, link).


Acknowledgement sent to Stefan Fritsch <sf@sfritsch.de>:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, Adeodato Simó <dato@net.com.org.es>. (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2007-2683: Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code
Date: Sat, 26 May 2007 14:03:42 +0200
Package: mutt
Version: 1.5.13-3
Severity: important
Tags: security

A vulnerability has been found in mutt. From CVE-2007-2683:
"Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code
via "&" characters in the GECOS field, which triggers the overflow during alias
expansion."

More information is available at:

http://dev.mutt.org/trac/ticket/2885



Bug marked as found in version 1.5.13-1.1. Request was from Stefan Fritsch <sf@debian.org> to control@bugs.debian.org. (Sat, 26 May 2007 12:21:22 GMT) (full text, mbox, link).


Bug marked as found in version 1.5.9-2sarge2. Request was from Stefan Fritsch <sf@debian.org> to control@bugs.debian.org. (Sat, 26 May 2007 12:21:24 GMT) (full text, mbox, link).


Tags added: security Request was from Bas Zoetekouw <bas@debian.org> to control@bugs.debian.org. (Sun, 01 Jul 2007 09:00:02 GMT) (full text, mbox, link).


Noted your statement that Bug has been forwarded to http://bugs.mutt.org/2885. Request was from Christoph Berg <myon@debian.org> to control@bugs.debian.org. (Fri, 06 Jul 2007 22:09:07 GMT) (full text, mbox, link).


Bug marked as found in version 1.5.9-2sarge1 and reopened. Request was from Christoph Berg <myon@debian.org> to control@bugs.debian.org. (Fri, 06 Jul 2007 22:42:03 GMT) (full text, mbox, link).


Bug marked as fixed in version 1.5.15+20070608-1. Request was from Christoph Berg <myon@debian.org> to control@bugs.debian.org. (Fri, 06 Jul 2007 22:48:02 GMT) (full text, mbox, link).


Bug closed, send any further explanations to Stefan Fritsch <sf@sfritsch.de> Request was from Christoph Berg <myon@debian.org> to control@bugs.debian.org. (Fri, 06 Jul 2007 23:33:02 GMT) (full text, mbox, link).


Tags added: fixed-upstream Request was from bts-link-upstream@lists.alioth.debian.org to control@bugs.debian.org. (Sun, 29 Jul 2007 14:42:19 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 27 Aug 2007 07:27:02 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 19:12:31 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.