Debian dla-4897 : mutt - security update

low Nessus Plugin ID 379744

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4897 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4897-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA November 12, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : mutt Version : 2.2.12-0.1~deb12u2 CVE ID : CVE-2026-43859 CVE-2026-43860 CVE-2026-43861 CVE-2026-43862 CVE-2026-43863 CVE-2026-43864 CVE-2026-107570

Multiple security issues were discovered in mutt, a text-based MUA.

CVE-2026-43859

uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

CVE-2026-43860

truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.

CVE-2026-43861

does not check for '\0' in url_pct_decode.

CVE-2026-43862

the imap_auth_gss security level is mishandled.

CVE-2026-43863

an infinite loop in data_object_to_stream in crypt-gpgme.c

CVE-2026-43864

a show_sig_summary NULL pointer dereference.

CVE-2026-107570

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

For Debian 12 bookworm, these problems have been fixed in version 2.2.12-0.1~deb12u2.

We recommend that you upgrade your mutt packages.

For the detailed security status of mutt please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mutt

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the mutt packages.

Plugin Details

Severity: Low

ID: 379744

File Name: debian_DLA-4897.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-107570

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-43862

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:mutt

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 5/4/2026

Reference Information

CVE: CVE-2026-107570, CVE-2026-43859, CVE-2026-43860, CVE-2026-43861, CVE-2026-43862, CVE-2026-43863, CVE-2026-43864

Detections

Analytics