Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the mutt-2.2.6-1.el9 build changelog.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8219 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mutt installed on the remote host is prior to 1.5.20-7.20091214hg736b6a.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1865 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mutt installed on the remote host is prior to 1.5.21-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1892 advisory.

  - Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
    (CVE-2020-14093)

  - Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the     user rejects an expired intermediate certificate. (CVE-2020-14154)

  - Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP,     and POP3. When a server sends a begin TLS response, the client reads additional data (e.g., from a man-     in-the-middle attacker) and evaluates it in a TLS context, aka response injection. (CVE-2020-14954)

  - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an     IMAP server's initial server response was invalid. The connection was not properly closed, and the code     could continue attempting to authenticate. This could result in authentication credentials being exposed     on an unencrypted connection, or to a machine-in-the-middle. (CVE-2020-28896)

  - rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox     unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields     (aka terminators of empty groups). A small email message from the attacker can cause large memory     consumption, and the victim may then be unable to see email messages from other persons. (CVE-2021-3181)

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-8219 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:8219 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7640 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8219 advisory.

  - mutt: buffer overflow in uudecoder function (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-7640 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:7640 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:7640 advisory.

  - mutt: buffer overflow in uudecoder function (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7640 advisory.

  - mutt: buffer overflow in uudecoder function (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2999 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:1478-1 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5392-1 advisory.

  - Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync     issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a     comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default. (CVE-2021-32055)

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1376-1 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6eb9cf14-bab0-11ec-8f59-4437e6ad11c4 advisory.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191229	CentOS 9 : mutt-2.2.6-1.el9	Nessus	CentOS Local Security Checks	medium
184631	Rocky Linux 9 : mutt (RLSA-2022:8219)	Nessus	Rocky Linux Local Security Checks	medium
183850	Amazon Linux AMI : mutt (ALAS-2023-1865)	Nessus	Amazon Linux Local Security Checks	medium
168438	Amazon Linux 2 : mutt (ALAS-2022-1892)	Nessus	Amazon Linux Local Security Checks	medium
168061	Oracle Linux 9 : mutt (ELSA-2022-8219)	Nessus	Oracle Linux Local Security Checks	medium
167959	AlmaLinux 9 : mutt (ALSA-2022:8219)	Nessus	Alma Linux Local Security Checks	medium
167831	Rocky Linux 8 : mutt (RLSA-2022:7640)	Nessus	Rocky Linux Local Security Checks	medium
167610	RHEL 9 : mutt (RHSA-2022:8219)	Nessus	Red Hat Local Security Checks	medium
167536	Oracle Linux 8 : mutt (ELSA-2022-7640)	Nessus	Oracle Linux Local Security Checks	medium
167305	AlmaLinux 8 : mutt (ALSA-2022:7640)	Nessus	Alma Linux Local Security Checks	medium
167187	CentOS 8 : mutt (CESA-2022:7640)	Nessus	CentOS Local Security Checks	medium
167124	RHEL 8 : mutt (RHSA-2022:7640)	Nessus	Red Hat Local Security Checks	medium
163566	EulerOS 2.0 SP10 : mutt (EulerOS-SA-2022-2163)	Nessus	Huawei Local Security Checks	medium
163536	EulerOS 2.0 SP10 : mutt (EulerOS-SA-2022-2138)	Nessus	Huawei Local Security Checks	medium
162366	EulerOS 2.0 SP5 : mutt (EulerOS-SA-2022-1904)	Nessus	Huawei Local Security Checks	medium
160971	Debian DLA-2999-1 : mutt - LTS security update	Nessus	Debian Local Security Checks	medium
160382	SUSE SLES12 Security Update : mutt (SUSE-SU-2022:1478-1)	Nessus	SuSE Local Security Checks	medium
160290	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Mutt vulnerabilities (USN-5392-1)	Nessus	Ubuntu Local Security Checks	critical
160195	SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2022:1376-1)	Nessus	SuSE Local Security Checks	medium
159765	FreeBSD : mutt -- mutt_decode_uuencoded() can read past the of the input line (6eb9cf14-bab0-11ec-8f59-4437e6ad11c4)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-1328

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium