CVE-2023-4874

Published: Sep 9, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12

Affected (4)

Products: Mutt: Mutt · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mutt Mutt	After 1.5.2 to 2.2.12

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Related CWEs

Undefined Behavior for Input to API

The behavior of this function is undefined unless its control parameter is set to a specific value.

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (7)

https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0.patch

Source: cve@gitlab.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2023/09/26/6

Source: af854a3a-2127-422b-91ae-364da2661108

https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0.patch

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00021.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2023/dsa-5494

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.