MU
Vendor
mutt
53
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107570 | MU mutt mutt | 2.5 | Oct 8 | Use of Out-of-range Pointer Offset in mutt |
| CVE-2026-43864 | MU mutt mutt | 2.5 | May 4 | mutt before 2.3.2 has a show_sig_summary NULL pointer dereference |
| CVE-2026-43863 | MU mutt mutt | 3.7 | May 4 | mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c |
| CVE-2026-43862 | MU mutt mutt | 3.7 | May 4 | In mutt before 2.3.2, the imap_auth_gss security level is mishandled |
| CVE-2026-43861 | MU mutt mutt | 3.7 | May 4 | mutt before 2.3.2 does not check for '\0' in url_pct_decode |
| CVE-2026-43860 | MU mutt mutt | 3.7 | May 4 | mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest |
| CVE-2026-43859 | MU mutt mutt | 3.7 | May 4 | mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest |
| CVE-2024-49395 | MU Mutt Mutt | 5.3 | Nov 12 | In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info |
| CVE-2024-49394 | MU Mutt Mutt | 5.3 | Nov 12 | In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to… |
| CVE-2024-49393 | MU Mutt Mutt | 6.5 | Nov 12 | In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include… |
| CVE-2023-4875 | MU Mutt Mutt | 5.7 | Sep 9 | Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 |
| CVE-2023-4874 | MU Mutt Mutt | 6.5 | Sep 9 | Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 |
| CVE-2022-1328 | MU Mutt Mutt | 5.3 | Apr 14 | Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line |
| CVE-2021-32055 | MU Mutt Mutt | 9.1 | May 5 | Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an… |
| CVE-2021-3181 | MU Mutt Mutt | 6.5 | Jan 19 | rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in… |
| CVE-2020-28896 | MU Mutt Mutt | 5.3 | Nov 23 | Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid |
| CVE-2020-14954 | MU Mutt Mutt | 5.9 | Jun 21 | Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3 |
| CVE-2020-14154 | MU Mutt Mutt | 4.8 | Jun 15 | Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate |
| CVE-2020-14093 | MU Mutt Mutt | 5.9 | Jun 15 | Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response |
| CVE-2005-2351 | MU Mutt Mutt | 5.5 | Nov 1 | Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files |
| CVE-2018-14362 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14359 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14358 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14357 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14356 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14355 | MU Mutt Mutt | 5.3 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14354 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14353 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14352 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14351 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14350 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2018-14349 | MU Mutt Mutt | 9.8 | Jul 17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16 |
| CVE-2014-9116 | MU Mutt Mutt | – | Dec 2 | The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service… |
| CVE-2014-0467 | MU Mutt Mutt | – | Mar 14 | Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion |
| CVE-2011-1429 | MU Mutt Mutt | – | Mar 16 | Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP… |
| CVE-2009-3766 | MU Mutt Mutt | – | Oct 23 | mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate,… |
| CVE-2009-3765 | MU Mutt Mutt | – | Oct 23 | mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509… |
| CVE-2009-1390 | MU Mutt Mutt | – | Jun 16 | Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of… |
| CVE-2007-2683 | MU Mutt Mutt | – | May 15 | Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion |
| CVE-2007-1268 | MU Mutt Mutt | – | Mar 6 | Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions… |
| CVE-2006-5297 | MU Mutt Mutt | – | Oct 16 | Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary… |
| CVE-2006-5298 | MU Mutt Mutt | – | Oct 16 | The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might… |
| CVE-2006-3242 | MU Mutt Mutt | – | Jun 27 | Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or… |
| CVE-2005-2642 | MU Mutt Mutt | – | Aug 23 | Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions with libiconv or… |
| CVE-2004-0078 | MU Mutt Mutt | – | Mar 3 | Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute… |
| CVE-2003-0300 | MU Mutt Mutt | – | Jun 16 | The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause either integer… |
| CVE-2003-0299 | MU Mutt Mutt | – | Jun 16 | The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large… |
| CVE-2003-0167 | MU Mutt Mutt | – | Apr 2 | Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of… |
| CVE-2003-0140 | MU Mutt Mutt | – | Mar 24 | Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP… |
| CVE-2002-0001 | MU Mutt Mutt | – | Feb 27 | Vulnerability in RFC822 address parser in mutt before 1.2.5.1 and mutt 1.3.x before 1.3.25 allows remote attackers to execute arbitrary commands via an improperly terminated… |
| CVE-2001-0473 | MU Mutt Mutt | – | Jun 27 | Format string vulnerability in Mutt before 1.2.5 allows a remote malicious IMAP server to execute arbitrary commands |
| CVE-1999-0940 | MM Mutt Mail Client Mutt | – | Sep 27 | Buffer overflow in mutt mail client allows remote attackers to execute commands via malformed MIME messages |
| CVE-1999-0941 | MU Mutt Mutt | – | Jul 28 | Mutt mail client allows a remote attacker to execute commands via shell metacharacters |