Description
emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | notmuch | 0.11.1-1 | — |
| Debian 13 | notmuch | 0.11.1-1 | — |
| Debian 12 | notmuch | 0.11.1-1 | — |
| Debian 6.0 | notmuch | 0.3.1+squeeze1 | DSA-2416-1 |
Advisories 1
- DSA-2416-1 notmuch - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://notmuchmail.org/news/release-0.11.1/
- 52155 vdb-entry
- [oss-security] 20120304 Re: CVE request: notmuch mailing-list
- DSA-2416 vendor-advisory
- http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el
- [oss-security] 20120304 CVE request: notmuch mailing-list
- 48139 third-party-advisory