|
Lines 58-63
Notes:
Link Here
|
| 58 |
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.) |
58 |
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.) |
| 59 |
--> |
59 |
--> |
| 60 |
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> |
60 |
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> |
|
|
61 |
<vuln vid="c133fcbe-8924-11e8-8fa5-4437e6ad11c4"> |
| 62 |
<topic>mutt -- remote code injection and path traversal vulnerability</topic> |
| 63 |
<affects> |
| 64 |
<package> |
| 65 |
<name>mutt</name> |
| 66 |
<range><lt>1.10.1</lt></range> |
| 67 |
</package> |
| 68 |
</affects> |
| 69 |
<description> |
| 70 |
<body xmlns="http://www.w3.org/1999/xhtml"> |
| 71 |
<p>Kevin J. McCarthy reports:</p> |
| 72 |
<blockquote cite="http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html"> |
| 73 |
<p> Fixes a remote code injection vulnerability when "subscribing" |
| 74 |
to an IMAP mailbox, either via $imap_check_subscribed, or via the |
| 75 |
<subscribe> function in the browser menu. Mutt was generating a |
| 76 |
"mailboxes" command and sending that along to the muttrc parser. |
| 77 |
However, it was not escaping "`", which executes code and inserts |
| 78 |
the result. This would allow a malicious IMAP server to execute |
| 79 |
arbitrary code (for $imap_check_subscribed).</p> |
| 80 |
<p>Fixes POP body caching path traversal vulnerability.</p> |
| 81 |
<p>Fixes IMAP header caching path traversal vulnerability.</p> |
| 82 |
</blockquote> |
| 83 |
</body> |
| 84 |
</description> |
| 85 |
<references> |
| 86 |
<url>http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html</url> |
| 87 |
</references> |
| 88 |
<dates> |
| 89 |
<discovery>2018-07-15</discovery> |
| 90 |
<entry>2018-07-16</entry> |
| 91 |
</dates> |
| 92 |
</vuln> |
| 93 |
|
| 61 |
<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b"> |
94 |
<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b"> |
| 62 |
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic> |
95 |
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic> |
| 63 |
<affects> |
96 |
<affects> |
| 64 |
- |
|
|