CVE-2018-14362

Опубликовано: 17 июл. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.

Ссылки

http://www.mutt.org/news.html
Release Notes
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2526
Third Party Advisory
https://github.com/neomutt/neomutt/commit/9bfab35522301794483f8f9ed60820bdec9be59e
Patch
Third Party Advisory
https://gitlab.com/muttmua/mutt/commit/6aed28b40a0410ec47d40c8c7296d8d10bae7576
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html
Mailing List
Third Party Advisory
https://neomutt.org/2018/07/16/release
Release Notes
Vendor Advisory
https://security.gentoo.org/glsa/201810-07
Third Party Advisory
https://usn.ubuntu.com/3719-3/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4277
Third Party Advisory
http://www.mutt.org/news.html
Release Notes
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2526
Third Party Advisory
https://github.com/neomutt/neomutt/commit/9bfab35522301794483f8f9ed60820bdec9be59e
Patch
Third Party Advisory
https://gitlab.com/muttmua/mutt/commit/6aed28b40a0410ec47d40c8c7296d8d10bae7576
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html
Mailing List
Third Party Advisory
https://neomutt.org/2018/07/16/release
Release Notes
Vendor Advisory
https://security.gentoo.org/glsa/201810-07
Third Party Advisory
https://usn.ubuntu.com/3719-3/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4277
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:*

Версия до 1.10.1 (исключая)

cpe:2.3:a:neomutt:neomutt:*:*:*:*:*:*:*:*

Версия до 20180716 (исключая)

Конфигурация 2

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02201

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-119

Связанные уязвимости

CVE-2018-14362

CVSS3: 9.8

ubuntu

больше 7 лет назад

CVE-2018-14362

CVSS3: 6.5

redhat

больше 7 лет назад

CVE-2018-14362

CVSS3: 9.8

debian

больше 7 лет назад

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018- ...

GHSA-8wxh-p6hf-c3ph

CVSS3: 9.8

github

больше 3 лет назад

BDU:2019-00511

CVSS3: 9.8

fstec

около 7 лет назад

Уязвимость в коде «pop.c» почтовых клиентов Mutt и NeoMutt, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 84%

0.02201

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-119