--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-f1438c5833
2018-07-31 18:00:51.599513
--------------------------------------------------------------------------------
Name : mutt
Product : Fedora 28
Version : 1.10.1
Release : 1.fc28
URL :
http://www.mutt.org
Summary : A text mode mail user agent
Description :
Mutt is a small but very powerful text-based MIME mail client. Mutt
is highly configurable, and is well suited to the mail power user with
advanced features like key bindings, keyboard macros, mail threading,
regular expression searches and a powerful pattern matching language
for selecting groups of messages.
--------------------------------------------------------------------------------
Update Information:
Upgrade to 1.10.1 Security fix for CVE-2018-14358, CVE-2018-14352,
CVE-2018-14353, CVE-2018-14356, CVE-2018-14359, CVE-2018-14354, CVE-2018-14355,
CVE-2018-14362, CVE-2018-14357, CVE-2018-14350, CVE-2018-14349, CVE-2018-14351
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 17 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.10.1-1
- Upgrade to 1.10.1
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
5:1.10.0-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu May 24 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.10.0-2
- Disable post-install mutt_dotlock checking by patch, not by sed.
* Tue May 22 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.10.0-1
- Upgrade to 1.10.0
* Thu Apr 19 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.9.5-4
- Disable dotlock by patch instead of sed
- Resolves: #1568597
* Wed Apr 18 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.9.5-3
- Apply patches of autoreconf related configuration files before running
autoreconf
* Mon Apr 16 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.9.5-2
- Use libidn2 instead of libidn
* Mon Apr 16 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.9.5-1
- Upgrade to 1.9.5
* Fri Apr 13 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.9.4-2
- Use lynx to generate documentation
* Mon Apr 9 2018 Matej Mu��ila <mmuzila(a)redhat.com> - 5:1.9.4-1
- Upgrade to 1.9.4
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1602915 - CVE-2018-14357 mutt: Remote Code Execution via backquote
characters
https://bugzilla.redhat.com/show_bug.cgi?id=1602915
[ 2 ] Bug #1602069 - CVE-2018-14354 mutt: Remote code injection vulnerability to an IMAP
mailbox
https://bugzilla.redhat.com/show_bug.cgi?id=1602069
[ 3 ] Bug #1602079 - CVE-2018-14362 mutt: POP body caching path traversal vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=1602079
[ 4 ] Bug #1602081 - CVE-2018-14355 mutt: IMAP header caching path traversal
vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=1602081
[ 5 ] Bug #1602922 - CVE-2018-14350 mutt: stack-based buffer overflow in imap/message.c
https://bugzilla.redhat.com/show_bug.cgi?id=1602922
[ 6 ] Bug #1602934 - CVE-2018-14349 mutt: Heap Overflow in imap/command.c
https://bugzilla.redhat.com/show_bug.cgi?id=1602934
[ 7 ] Bug #1602953 - CVE-2018-14351 mutt: IMAP status mailbox literal mishandled in
imap/command.c
https://bugzilla.redhat.com/show_bug.cgi?id=1602953
[ 8 ] Bug #1604034 - CVE-2018-14352 mutt: stack-based buffer overflow in imap/util.c
https://bugzilla.redhat.com/show_bug.cgi?id=1604034
[ 9 ] Bug #1604040 - CVE-2018-14353 mutt: integer underflow in imap/util.c
https://bugzilla.redhat.com/show_bug.cgi?id=1604040
[ 10 ] Bug #1604047 - CVE-2018-14356 mutt: mishandles a zero-length UID in pop.c
https://bugzilla.redhat.com/show_bug.cgi?id=1604047
[ 11 ] Bug #1604064 - CVE-2018-14358 mutt: stack-based buffer overflow in
imap/message.c
https://bugzilla.redhat.com/show_bug.cgi?id=1604064
[ 12 ] Bug #1604084 - CVE-2018-14359 mutt: buffer overflow via base64 data
https://bugzilla.redhat.com/show_bug.cgi?id=1604084
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-f1438c5833' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------