Bug 1101576 – VUL-0: CVE-2018-14356: mutt,neomutt: pop.c mishandles a zero-length UID.

Bug 1101576 - (CVE-2018-14356) VUL-0: CVE-2018-14356: mutt,neomutt: pop.c mishandles a zero-length UID.

(CVE-2018-14356)
Summary:	VUL-0: CVE-2018-14356: mutt,neomutt: pop.c mishandles a zero-length UID.

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/210787/
Whiteboard:	CVSSv3:SUSE:CVE-2018-14356:5.3:(AV:N/...
Keywords:

Depends on:
Blocks:	1101428
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2018-07-18 07:22 UTC by Karol Babioch
Modified:	2019-05-09 10:10 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
pop-e154cba1.patch for SLES-11 (736 bytes, text/plain) 2018-07-23 14:07 UTC, Dr. Werner Fink	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Karol Babioch 2018-07-18 07:22:25 UTC

CVE-2018-14356

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.
pop.c mishandles a zero-length UID.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14356
https://github.com/neomutt/neomutt/commit/93b8ac558752d09e1c56d4f1bc82631316fa9c82
https://gitlab.com/muttmua/mutt/commit/e154cba1b3fc52bb8cb8aa846353c0db79b5d9c6

Comment 1 Swamp Workflow Management 2018-07-18 08:50:35 UTC

This is an autogenerated message for OBS integration:
This bug (1101576) was mentioned in
https://build.opensuse.org/request/show/623577 Factory / mutt

Comment 7 Dr. Werner Fink 2018-07-23 14:07:23 UTC

Created attachment 777757 [details]
pop-e154cba1.patch for SLES-11

Comment 11 Swamp Workflow Management 2018-08-06 13:15:15 UTC

openSUSE-SU-2018:2212-1: An update that solves 16 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1094717,1101428,1101566,1101567,1101568,1101569,1101570,1101571,1101573,1101576,1101577,1101578,1101581,1101582,1101583,1101588,1101589
CVE References: CVE-2014-9116,CVE-2018-14349,CVE-2018-14350,CVE-2018-14351,CVE-2018-14352,CVE-2018-14353,CVE-2018-14354,CVE-2018-14355,CVE-2018-14356,CVE-2018-14357,CVE-2018-14358,CVE-2018-14359,CVE-2018-14360,CVE-2018-14361,CVE-2018-14362,CVE-2018-14363
Sources used:
openSUSE Leap 15.0 (src):    mutt-1.10.1-lp150.2.3.1

Comment 12 Swamp Workflow Management 2018-08-17 10:19:00 UTC

SUSE-SU-2018:2403-1: An update that solves 11 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1101567,1101570,1101571,1101573,1101576,1101577,1101578,1101581,1101582,1101588,1101589,936807
CVE References: CVE-2018-14349,CVE-2018-14350,CVE-2018-14352,CVE-2018-14353,CVE-2018-14354,CVE-2018-14355,CVE-2018-14356,CVE-2018-14357,CVE-2018-14358,CVE-2018-14359,CVE-2018-14362
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    mutt-1.5.17-42.43.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    mutt-1.5.17-42.43.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    mutt-1.5.17-42.43.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    mutt-1.5.17-42.43.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    mutt-1.5.17-42.43.1

Comment 14 Swamp Workflow Management 2018-09-11 06:02:15 UTC

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2018-09-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64138

Comment 15 Swamp Workflow Management 2019-01-07 15:41:08 UTC

This is an autogenerated message for OBS integration:
This bug (1101576) was mentioned in
https://build.opensuse.org/request/show/663361 42.3 / mutt

Comment 16 Swamp Workflow Management 2019-01-17 17:12:19 UTC

openSUSE-SU-2019:0052-1: An update that solves 16 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 1061343,1094717,1101428,1101566,1101567,1101568,1101569,1101570,1101571,1101573,1101576,1101577,1101578,1101581,1101582,1101583,1101588,1101589,1120935,980830,982129,986534
CVE References: CVE-2014-9116,CVE-2018-14349,CVE-2018-14350,CVE-2018-14351,CVE-2018-14352,CVE-2018-14353,CVE-2018-14354,CVE-2018-14355,CVE-2018-14356,CVE-2018-14357,CVE-2018-14358,CVE-2018-14359,CVE-2018-14360,CVE-2018-14361,CVE-2018-14362,CVE-2018-14363
Sources used:
openSUSE Leap 42.3 (src):    mutt-1.10.1-2.5.1

Comment 17 Marcus Meissner 2019-01-18 14:21:10 UTC

released

Comment 18 Swamp Workflow Management 2019-05-09 10:10:25 UTC

SUSE-SU-2019:1196-1: An update that solves 16 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1061343,1094717,1101428,1101566,1101567,1101568,1101569,1101570,1101571,1101573,1101576,1101577,1101578,1101581,1101582,1101583,1101588,1101589,980830,982129,986534
CVE References: CVE-2014-9116,CVE-2018-14349,CVE-2018-14350,CVE-2018-14351,CVE-2018-14352,CVE-2018-14353,CVE-2018-14354,CVE-2018-14355,CVE-2018-14356,CVE-2018-14357,CVE-2018-14358,CVE-2018-14359,CVE-2018-14360,CVE-2018-14361,CVE-2018-14362,CVE-2018-14363
Sources used:
SUSE Linux Enterprise Server 12-SP3 (src):    mutt-1.10.1-55.6.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    mutt-1.10.1-55.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.