CVE-2022-1328

Published on: Not Yet Published

Last Modified on: 10/14/2022 12:49:00 PM UTC

CVE-2022-1328

Source: Mitre Source: NIST CVE.ORG Print: PDF PDF
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Certain versions of Debian Linux from Debian contain the following vulnerability:

Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line

  • CVE-2022-1328 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as MEDIUM severity.
  • Affected Vendor/Software: URL Logo Mutt - Mutt version >=0.94.13, <2.2.3

CVSS3 Score: 5.3 - MEDIUM

Attack
Vector ⓘ		 Attack
Complexity		 Privileges
Required		 User
Interaction
NETWORK LOW NONE NONE
Scope Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
UNCHANGED LOW NONE NONE

CVSS2 Score: 5 - MEDIUM

Access
Vector ⓘ		 Access
Complexity		 Authentication
NETWORK LOW NONE
Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
PARTIAL NONE NONE

CVE References

Description Tags ⓘ Link
[SECURITY] Fedora 36 Update: mutt-2.2.5-1.fc36 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
 URL Logo FEDORA FEDORA-2022-f1a8f72bb8
Fix uudecode buffer overflow. (e5ed080c) · Commits · Mutt Project / mutt · GitLab gitlab.com
text/html
 URL Logo MISC gitlab.com/muttmua/mutt/-/commit/e5ed080c00e59701ca62ef9b2a6d2612ebf765a5
[SECURITY] [DLA 2999-1] mutt security update lists.debian.org
text/html
 URL Logo MLIST [debian-lts-announce] 20220510 [SECURITY] [DLA 2999-1] mutt security update
SECURITY: mutt_decode_uuencoded() can read past the of the input line (#404) · Issues · Mutt Project / mutt · GitLab gitlab.com
text/html
 URL Logo MISC gitlab.com/muttmua/mutt/-/issues/404
oss-security - mutt 2.2.3 released - fixes CVE-2022-1328 www.openwall.com
text/html
 URL Logo MLIST [oss-security] 20220414 mutt 2.2.3 released - fixes CVE-2022-1328
2022/CVE-2022-1328.json · master · GitLab.org / cves · GitLab gitlab.com
text/html
 URL Logo CONFIRM gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1328.json
Mutt mutt_decode_uuencoded() Memory Disclosure ≈ Packet Storm packetstormsecurity.com
text/html
 URL Logo MISC packetstormsecurity.com/files/167717/Mutt-mutt_decode_uuencoded-Memory-Disclosure.html
By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

  • 160214 Oracle Enterprise Linux Security Update for mutt (ELSA-2022-7640)
  • 160299 Oracle Enterprise Linux Security Update for mutt (ELSA-2022-8219)
  • 179275 Debian Security Update for mutt (DLA 2999-1)
  • 180860 Debian Security Update for mutt (CVE-2022-1328)
  • 198757 Ubuntu Security Notification for Mutt Vulnerabilities (USN-5392-1)
  • 240831 Red Hat Update for mutt (RHSA-2022:7640)
  • 240897 Red Hat Update for mutt (RHSA-2022:8219)
  • 282814 Fedora Security Update for mutt (FEDORA-2022-f1a8f72bb8)
  • 296082 Oracle Solaris 11.4 Support Repository Update (SRU) 48.126.1 Missing (CPUJUL2022)
  • 354118 Amazon Linux Security Advisory for mutt : ALAS2-2022-1892
  • 502119 Alpine Linux Security Update for mutt
  • 671831 EulerOS Security Update for mutt (EulerOS-SA-2022-1904)
  • 671986 EulerOS Security Update for mutt (EulerOS-SA-2022-2138)
  • 672012 EulerOS Security Update for mutt (EulerOS-SA-2022-2163)
  • 690845 Free Berkeley Software Distribution (FreeBSD) Security Update for mutt (6eb9cf14-bab0-11ec-8f59-4437e6ad11c4)
  • 752074 SUSE Enterprise Linux Security Update for mutt (SUSE-SU-2022:1376-1)
  • 752091 SUSE Enterprise Linux Security Update for mutt (SUSE-SU-2022:1478-1)
  • 901786 Common Base Linux Mariner (CBL-Mariner) Security Update for mutt (9472)
  • 940767 AlmaLinux Security Update for mutt (ALSA-2022:7640)
  • 940808 AlmaLinux Security Update for mutt (ALSA-2022:8219)
  • 960174 Rocky Linux Security Update for mutt (RLSA-2022:7640)
  • 960548 Rocky Linux Security Update for mutt (RLSA-2022:8219)

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System		DebianDebian Linux9.0AllAllAll
Operating
System		FedoraprojectFedora36AllAllAll
ApplicationMuttMuttAllAllAllAll
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*:
  • cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:*:

Discovery Credit

Tavis Ormandy

Social Mentions

Source Title Posted (UTC)
Twitter Icon @OpenBSD_ports [email protected] modified mail/mutt: update to mutt-2.2.3 This is a bug-fix release, addressing CVE-2022-1328: a buffer overr… twitter.com/i/web/status/1… 2022-04-12 20:55:23
Twitter Icon @CVEreport CVE-2022-1328 : Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allo… twitter.com/i/web/status/1… 2022-04-14 21:13:30
Twitter Icon @LinInfoSec Gitlab - CVE-2022-1328: gitlab.com/muttmua/mutt/-… 2022-04-14 23:00:06
Reddit Logo Icon /r/netcve CVE-2022-1328 2022-04-14 22:38:11
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report