---------------------------------------------------------------------Fedora Update Notification
FEDORA-2007-540
2007-05-30
---------------------------------------------------------------------Product     : Fedora Core 5
Name        : mutt
Version     : 1.4.2.1
Release     : 8.fc5
Summary     : A text mode mail user agent.
Description :
Mutt is a text-mode mail user agent. Mutt supports color, threading,
arbitrary key remapping, and a lot of customization.

You should install mutt if you have used it in the past and you prefer
it, or if you are new to mail programs and have not decided which one
you are going to use.

---------------------------------------------------------------------Update Information:

This update fixes two security issues:

The APOP protocol allows remote attackers to guess the first
3 characters of a password via man-in-the-middle (MITM)
attacks that use crafted message IDs and MD5 collisions.
(CVE-2007-1558)

Buffer overflow in Mutt 1.4.2 might allow local users to
execute arbitrary code via "&" characters in the GECOS
field, which triggers the overflow during alias expansion.
(CVE-2007-2683)


---------------------------------------------------------------------* Mon May 28 2007 Miroslav Lichvar  5:1.4.2.1-8.fc5
- validate msgid in APOP authentication (CVE-2007-1558)
- fix overflow in gecos field handling (CVE-2007-2683)
* Tue Oct 24 2006 Miroslav Lichvar  5:1.4.2.1-7.fc5
- fix insecure temp file creation on NFS (#211085, CVE-2006-5297)
* Thu Jun 29 2006 Miroslav Lichvar  5:1.4.2.1-6.3.fc5
- fix a buffer overflow when processing IMAP namespace (#197152, CVE-2006-3242)

---------------------------------------------------------------------This update can be downloaded from:
    
829bced13a1026fcc26c161386732e07b7334808  SRPMS/mutt-1.4.2.1-8.fc5.src.rpm
829bced13a1026fcc26c161386732e07b7334808  noarch/mutt-1.4.2.1-8.fc5.src.rpm
37ccd07e00e3029df4b0a6861e9ab990778cd527  ppc/mutt-1.4.2.1-8.fc5.ppc.rpm
6cac8e87786bcf6925c99314ce4b9d5bb0886e63  ppc/debug/mutt-debuginfo-1.4.2.1-8.fc5.ppc.rpm
f27e2f4eb28efdbb7259318d8e3e3b4a25093d0d  x86_64/debug/mutt-debuginfo-1.4.2.1-8.fc5.x86_64.rpm
0fd6fbf7cbf974394661316d2cc114b4fbe74e6a  x86_64/mutt-1.4.2.1-8.fc5.x86_64.rpm
5838b7ac7ec9482525a6f10a2a8229ce24b0ced3  i386/mutt-1.4.2.1-8.fc5.i386.rpm
ed22bb478f1330eb23f20ad2ff4e1f0887942836  i386/debug/mutt-debuginfo-1.4.2.1-8.fc5.i386.rpm

This update can be installed with the 'yum' update program.  Use 'yum update
package-name' at the command line.  For more information, refer to 'Managing
Software with yum,' available at .
---------------------------------------------------------------------_______________________________________________
Fedora-package-announce mailing list
Fedora-package-announce@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-package-announce

Fedora Core 5 Update: mutt-1.4.2.1-8.fc5

May 30, 2007
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions

Summary

Mutt is a text-mode mail user agent. Mutt supports color, threading,

arbitrary key remapping, and a lot of customization.

You should install mutt if you have used it in the past and you prefer

it, or if you are new to mail programs and have not decided which one

you are going to use.

This update fixes two security issues:

The APOP protocol allows remote attackers to guess the first

3 characters of a password via man-in-the-middle (MITM)

attacks that use crafted message IDs and MD5 collisions.

(CVE-2007-1558)

Buffer overflow in Mutt 1.4.2 might allow local users to

execute arbitrary code via "&" characters in the GECOS

field, which triggers the overflow during alias expansion.

(CVE-2007-2683)

- validate msgid in APOP authentication (CVE-2007-1558)

- fix overflow in gecos field handling (CVE-2007-2683)

* Tue Oct 24 2006 Miroslav Lichvar 5:1.4.2.1-7.fc5

- fix insecure temp file creation on NFS (#211085, CVE-2006-5297)

* Thu Jun 29 2006 Miroslav Lichvar 5:1.4.2.1-6.3.fc5

- fix a buffer overflow when processing IMAP namespace (#197152, CVE-2006-3242)

829bced13a1026fcc26c161386732e07b7334808 SRPMS/mutt-1.4.2.1-8.fc5.src.rpm

829bced13a1026fcc26c161386732e07b7334808 noarch/mutt-1.4.2.1-8.fc5.src.rpm

37ccd07e00e3029df4b0a6861e9ab990778cd527 ppc/mutt-1.4.2.1-8.fc5.ppc.rpm

6cac8e87786bcf6925c99314ce4b9d5bb0886e63 ppc/debug/mutt-debuginfo-1.4.2.1-8.fc5.ppc.rpm

f27e2f4eb28efdbb7259318d8e3e3b4a25093d0d x86_64/debug/mutt-debuginfo-1.4.2.1-8.fc5.x86_64.rpm

0fd6fbf7cbf974394661316d2cc114b4fbe74e6a x86_64/mutt-1.4.2.1-8.fc5.x86_64.rpm

5838b7ac7ec9482525a6f10a2a8229ce24b0ced3 i386/mutt-1.4.2.1-8.fc5.i386.rpm

ed22bb478f1330eb23f20ad2ff4e1f0887942836 i386/debug/mutt-debuginfo-1.4.2.1-8.fc5.i386.rpm

This update can be installed with the 'yum' update program. Use 'yum update

package-name' at the command line. For more information, refer to 'Managing

Software with yum,' available at .

Fedora-package-announce mailing list

Fedora-package-announce@redhat.com

http://www.redhat.com/mailman/listinfo/fedora-package-announce

FEDORA-2007-540 2007-05-30 Name : mutt Version : 1.4.2.1 Release : 8.fc5 Summary : A text mode mail user agent. Description : Mutt is a text-mode mail user agent. Mutt supports color, threading, arbitrary key remapping, and a lot of customization. You should install mutt if you have used it in the past and you prefer it, or if you are new to mail programs and have not decided which one you are going to use. This update fixes two security issues: The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. (CVE-2007-1558) Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion. (CVE-2007-2683) - validate msgid in APOP authentication (CVE-2007-1558) - fix overflow in gecos field handling (CVE-2007-2683) * Tue Oct 24 2006 Miroslav Lichvar 5:1.4.2.1-7.fc5 - fix insecure temp file creation on NFS (#211085, CVE-2006-5297) * Thu Jun 29 2006 Miroslav Lichvar 5:1.4.2.1-6.3.fc5 - fix a buffer overflow when processing IMAP namespace (#197152, CVE-2006-3242) 829bced13a1026fcc26c161386732e07b7334808 SRPMS/mutt-1.4.2.1-8.fc5.src.rpm 829bced13a1026fcc26c161386732e07b7334808 noarch/mutt-1.4.2.1-8.fc5.src.rpm 37ccd07e00e3029df4b0a6861e9ab990778cd527 ppc/mutt-1.4.2.1-8.fc5.ppc.rpm 6cac8e87786bcf6925c99314ce4b9d5bb0886e63 ppc/debug/mutt-debuginfo-1.4.2.1-8.fc5.ppc.rpm f27e2f4eb28efdbb7259318d8e3e3b4a25093d0d x86_64/debug/mutt-debuginfo-1.4.2.1-8.fc5.x86_64.rpm 0fd6fbf7cbf974394661316d2cc114b4fbe74e6a x86_64/mutt-1.4.2.1-8.fc5.x86_64.rpm 5838b7ac7ec9482525a6f10a2a8229ce24b0ced3 i386/mutt-1.4.2.1-8.fc5.i386.rpm ed22bb478f1330eb23f20ad2ff4e1f0887942836 i386/debug/mutt-debuginfo-1.4.2.1-8.fc5.i386.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at . Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-announce

Change Log

References

Update Instructions

Severity
Name : mutt
Version : 1.4.2.1
Release : 8.fc5
Summary : A text mode mail user agent.

Related News

24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved