From Fedora Project Wiki
[SECURITY] Fedora Core 5 Update: mutt-1.4.2.1-8.fc5
--------------------------------------------------------------------- Fedora Update Notification FEDORA-2007-540 2007-05-30 --------------------------------------------------------------------- Product : Fedora Core 5 Name : mutt Version : 1.4.2.1 Release : 8.fc5 Summary : A text mode mail user agent. Description : Mutt is a text-mode mail user agent. Mutt supports color, threading, arbitrary key remapping, and a lot of customization. You should install mutt if you have used it in the past and you prefer it, or if you are new to mail programs and have not decided which one you are going to use. --------------------------------------------------------------------- Update Information: This update fixes two security issues: The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. (CVE-2007-1558) Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion. (CVE-2007-2683) --------------------------------------------------------------------- * Mon May 28 2007 Miroslav Lichvar <mlichvar redhat com> 5:1.4.2.1-8.fc5 - validate msgid in APOP authentication (CVE-2007-1558) - fix overflow in gecos field handling (CVE-2007-2683) * Tue Oct 24 2006 Miroslav Lichvar <mlichvar redhat com> 5:1.4.2.1-7.fc5 - fix insecure temp file creation on NFS (#211085, CVE-2006-5297) * Thu Jun 29 2006 Miroslav Lichvar <mlichvar redhat com> 5:1.4.2.1-6.3.fc5 - fix a buffer overflow when processing IMAP namespace (#197152, CVE-2006-3242) --------------------------------------------------------------------- This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/ 829bced13a1026fcc26c161386732e07b7334808 SRPMS/mutt-1.4.2.1-8.fc5.src.rpm 829bced13a1026fcc26c161386732e07b7334808 noarch/mutt-1.4.2.1-8.fc5.src.rpm 37ccd07e00e3029df4b0a6861e9ab990778cd527 ppc/mutt-1.4.2.1-8.fc5.ppc.rpm 6cac8e87786bcf6925c99314ce4b9d5bb0886e63 ppc/debug/mutt-debuginfo-1.4.2.1-8.fc5.ppc.rpm f27e2f4eb28efdbb7259318d8e3e3b4a25093d0d x86_64/debug/mutt-debuginfo-1.4.2.1-8.fc5.x86_64.rpm 0fd6fbf7cbf974394661316d2cc114b4fbe74e6a x86_64/mutt-1.4.2.1-8.fc5.x86_64.rpm 5838b7ac7ec9482525a6f10a2a8229ce24b0ced3 i386/mutt-1.4.2.1-8.fc5.i386.rpm ed22bb478f1330eb23f20ad2ff4e1f0887942836 i386/debug/mutt-debuginfo-1.4.2.1-8.fc5.i386.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at http://fedora.redhat.com/docs/yum/. ---------------------------------------------------------------------