CVE-2003-0167 Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and poss...
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/balsa(Debian:12) | < 2.0.10 | 2.0.10 |
| debian/balsa(Debian:13) | < 2.0.10 | 2.0.10 |
| debian/balsa(Debian:14) | < 2.0.10 | 2.0.10 |
| debian/mutt(Debian:12) | < 1.4.0 | 1.4.0 |
| debian/mutt(Debian:13) | < 1.4.0 | 1.4.0 |
| debian/mutt(Debian:14) | < 1.4.0 | 1.4.0 |
| mutt | = 1.3.12 | No fix listed |
| mutt | = 1.3.12.1 | No fix listed |
| mutt | = 1.3.16 | No fix listed |
| mutt | = 1.3.17 | No fix listed |
| mutt | = 1.3.22 | No fix listed |
| mutt | = 1.3.24 | No fix listed |
| mutt | = 1.3.25 | No fix listed |
| mutt | = 1.3.27 | No fix listed |
| mutt | = 1.3.28 | No fix listed |
References
- Debian Security Tracker CVE-2003-0167 vendor-advisory
- DSA-274 patch vendor-advisory
- DSA-300 vendor-advisory
- 7229 patch vdb-entry vendor-advisory