1) Use after free in mutt before 1.13.5 From the changelog [0]: > Mutt 1.13.5 was released on March 28, 2020. This is a bug-fix release, fixing a use-after-free bug, and a couple format string processing bugs. Affects mutt <1.13.5. Bug: https://gitlab.com/muttmua/mutt/-/issues/214 Patch: https://gitlab.com/muttmua/mutt/-/commit/0266f6e4d5f7276fd171a9f80339566588151836 [0] http://www.mutt.org/news.html 2) Memory corruption in mutt 1.13.4 There are a few others but it's not necessarily worth digging up the commits and bugs for all of them.
(In reply to Sam James (sam_c) (security padawan) from comment #0) > There are a few others but it's not necessarily worth digging up the commits > and bugs for all of them. @maintainer(s): could you bump to 1.13.5 and then we'll stabilise that?
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4ed08d8150e512a92931542844b963a0739cfd28 commit 4ed08d8150e512a92931542844b963a0739cfd28 Author: Fabian Groffen <grobian@gentoo.org> AuthorDate: 2020-03-30 07:17:20 +0000 Commit: Fabian Groffen <grobian@gentoo.org> CommitDate: 2020-03-30 07:17:36 +0000 mail-client/mutt-1.13.5: version bump - new release addresses security bug - invalid USE-flags pgp_classic and smime_classic are removed Bug: https://bugs.gentoo.org/715352 Bug: https://bugs.gentoo.org/695078 Package-Manager: Portage-2.3.89, Repoman-2.3.20 Signed-off-by: Fabian Groffen <grobian@gentoo.org> mail-client/mutt/Manifest | 2 + mail-client/mutt/mutt-1.13.5.ebuild | 268 ++++++++++++++++++++++++++++++++++++ 2 files changed, 270 insertions(+)
Great, thanks for the quick response! @maintainer(s), please advise if ready for stabilisation, or call yourself.
given the delta from 1.13.4 is really small, I think we're ready to call 1.13.5 for stabilisation.
(In reply to Fabian Groffen from comment #4) > given the delta from 1.13.4 is really small, I think we're ready to call > 1.13.5 for stabilisation. Great, thank you. @arches, please stabilise: "amd64 arm hppa ia64 ppc ppc64 sparc x86"
An automated check of this bug failed - the following atom is unknown: mail-client/mutt Please verify the atom list.
Doh.
An automated check of this bug succeeded - the previous repoman errors are now resolved.
amd64 stable
hppa/sparc stable
arm stable
ppc stable
ppc64 stable
x86 stable
ia64 will pass. See https://archives.gentoo.org/gentoo-dev/message/edaadc85d7423810dd6ecfeda29cc85f
@maintainer(s), please cleanup
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5ed5ce158eb5bbdefe78f0332ab87823da905f11 commit 5ed5ce158eb5bbdefe78f0332ab87823da905f11 Author: Fabian Groffen <grobian@gentoo.org> AuthorDate: 2020-03-31 17:04:59 +0000 Commit: Fabian Groffen <grobian@gentoo.org> CommitDate: 2020-03-31 17:04:59 +0000 mail-client/mutt: security cleanup Bug: https://bugs.gentoo.org/715352 Closes: https://bugs.gentoo.org/695078 Package-Manager: Portage-2.3.89, Repoman-2.3.20 Signed-off-by: Fabian Groffen <grobian@gentoo.org> mail-client/mutt/Manifest | 6 - mail-client/mutt/metadata.xml | 7 - mail-client/mutt/mutt-1.10.1.ebuild | 282 --------------------------------- mail-client/mutt/mutt-1.12.2-r2.ebuild | 272 ------------------------------- mail-client/mutt/mutt-1.13.4-r1.ebuild | 261 ------------------------------ 5 files changed, 828 deletions(-)
Thanks!
GLSA Vote: No! Repository is clean, all done!
