According to the release announcement, "This is a bug-fix release, fixing two crash issues. One is possible by viewing a crafted message header, so upgrading is strongly recommended." Please stabilize 2.2.12.
Please cleanup.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b447922cb1cf28436eeb6ecea10ac7d1ea08ba53 commit b447922cb1cf28436eeb6ecea10ac7d1ea08ba53 Author: Fabian Groffen <grobian@gentoo.org> AuthorDate: 2023-11-23 07:51:18 +0000 Commit: Fabian Groffen <grobian@gentoo.org> CommitDate: 2023-11-23 07:51:18 +0000 mail-client/mutt: cleanup old and vulnerable Bug: https://bugs.gentoo.org/917610 Signed-off-by: Fabian Groffen <grobian@gentoo.org> mail-client/mutt/Manifest | 4 - mail-client/mutt/mutt-2.2.10.ebuild | 273 ------------------------------------ mail-client/mutt/mutt-2.2.3.ebuild | 262 ---------------------------------- 3 files changed, 539 deletions(-)
(CVEs are according to https://www.openwall.com/lists/oss-security/2023/09/26/6)
Not sure, is this the same bug? I got this crash with mutt 2.2.12: Core was generated by `mutt -f imaps://outlook.office365.com/'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f41c7c7a330 in SLang_do_key () from /usr/lib64/libslang.so.2 (gdb) bt #0 0x00007f41c7c7a330 in SLang_do_key () from /usr/lib64/libslang.so.2 #1 0x00007f41c7c9a75c in SLkp_getkey () from /usr/lib64/libslang.so.2 #2 0x00007f41c7c980e2 in SLcurses_wgetch () from /usr/lib64/libslang.so.2 #3 0x000055b9f2136e24 in mutt_monitor_getch () at curs_lib.c:145 #4 0x000055b9f2139460 in mutt_getch () at curs_lib.c:172 #5 0x000055b9f215aa67 in km_dokey (menu=2) at keymap.c:474 #6 0x000055b9f2161e90 in mutt_menuLoop (menu=0x55b9f2e3c7f0) at menu.c:1095 #7 0x000055b9f213260f in mutt_compose_menu (sctx=sctx@entry=0x55b9f2aa3f10) at compose.c:1103 #8 0x000055b9f218be39 in send_message_resume_compose_menu (sctx=sctx@entry=0x55b9f2aa3f10) at send.c:2412 #9 0x000055b9f218c865 in mutt_send_message_resume (psctx=psctx@entry=0x7ffefcf33160) at send.c:2752 #10 0x000055b9f218c99a in mutt_send_message (flags=flags@entry=49152, msg=msg@entry=0x0, tempfile=tempfile@entry=0x0, ctx=0x55b9f2ab8650, cur=cur@entry=0x0) at send.c:2822 #11 0x000055b9f2140c3d in mutt_index_menu () at curs_main.c:2503 #12 0x000055b9f215d3ad in main (argc=1, argv=<optimized out>, environ=<optimized out>) at main.c:1112
(In reply to Guilherme Amadio from comment #4) > Not sure, is this the same bug? I got this crash with mutt 2.2.12: > > Core was generated by `mutt -f imaps://outlook.office365.com/'. > Program terminated with signal SIGSEGV, Segmentation fault. > #0 0x00007f41c7c7a330 in SLang_do_key () from /usr/lib64/libslang.so.2 > (gdb) bt > #0 0x00007f41c7c7a330 in SLang_do_key () from /usr/lib64/libslang.so.2 > #1 0x00007f41c7c9a75c in SLkp_getkey () from /usr/lib64/libslang.so.2 > #2 0x00007f41c7c980e2 in SLcurses_wgetch () from /usr/lib64/libslang.so.2 > #3 0x000055b9f2136e24 in mutt_monitor_getch () at curs_lib.c:145 > #4 0x000055b9f2139460 in mutt_getch () at curs_lib.c:172 > #5 0x000055b9f215aa67 in km_dokey (menu=2) at keymap.c:474 > #6 0x000055b9f2161e90 in mutt_menuLoop (menu=0x55b9f2e3c7f0) at menu.c:1095 > #7 0x000055b9f213260f in mutt_compose_menu (sctx=sctx@entry=0x55b9f2aa3f10) > at compose.c:1103 > #8 0x000055b9f218be39 in send_message_resume_compose_menu > (sctx=sctx@entry=0x55b9f2aa3f10) at send.c:2412 > #9 0x000055b9f218c865 in mutt_send_message_resume > (psctx=psctx@entry=0x7ffefcf33160) at send.c:2752 > #10 0x000055b9f218c99a in mutt_send_message (flags=flags@entry=49152, > msg=msg@entry=0x0, tempfile=tempfile@entry=0x0, ctx=0x55b9f2ab8650, > cur=cur@entry=0x0) > at send.c:2822 > #11 0x000055b9f2140c3d in mutt_index_menu () at curs_main.c:2503 > #12 0x000055b9f215d3ad in main (argc=1, argv=<optimized out>, > environ=<optimized out>) at main.c:1112 That looks like a crash in the UI rather than mail parsing issues similar to what the patches fix, I think. I guess you've hit a UI bug, but not sure if it's security-relevant (ie triggerable by an attacker).
