ALAS2023-2023-357 — Moderate: mutt security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4875: Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 CVE-2023-4874: Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12

Fixed packages 3

Release	Package	Fixed in
Amazon Linux · 2023	mutt	5:2.2.9-1.amzn2023.0.2
Amazon Linux · 2023	mutt-debuginfo	5:2.2.9-1.amzn2023.0.2
Amazon Linux · 2023	mutt-debugsource	5:2.2.9-1.amzn2023.0.2

Vulnerabilities 2

Medium 4.3

CVE-2023-4874

Undefined Behavior for Input to API in Mutt

Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12

mutt mutt mutt mutt Debian Ubuntu Azure Linux

Sep 9, 2023
Low 2.2

CVE-2023-4875

Undefined Behavior for Input to API in Mutt

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

mutt mutt mutt mutt Debian Ubuntu Azure Linux

Sep 9, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-4874.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4875.html