CVE-2018-14357

CRITICAL

Mutt <1.10.1 - Command Injection

Title source: llm
STIX 2.1

Description

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.

References (10)

Core 10
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2526
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3719-3/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4277
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201810-07
Release Notes, Vendor Advisory x_refsource_misc
http://www.mutt.org/news.html
Release Notes, Vendor Advisory x_refsource_misc
https://neomutt.org/2018/07/16/release
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3719-1/

Scores

CVSS v3 9.8
EPSS 0.0235
EPSS Percentile 85.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (20)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
debian/debian_linux 8.0
debian/debian_linux 9.0
mutt/mutt < 1.10.1
neomutt/neomutt < 20180716
redhat/enterprise_linux_desktop 6.0
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 6.0
... and 10 more
Published Jul 17, 2018
Tracked Since Feb 18, 2026