1. CVE-Search
  2. CVE-2003-0140
ID CVE-2003-0140
Summary Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.
References
Vulnerable Configurations
  • cpe:2.3:a:mutt:mutt:1.3.12:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.3.16:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.16:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.3.17:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.17:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.3.22:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.22:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.3.24:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.24:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.3.25:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.25:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.3.27:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.3.27:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mutt:mutt:1.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:mutt:mutt:1.5.3:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-10-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
  • accepted 2007-04-25T19:52:22.102-04:00
    class vulnerability
    contributors
    • name Jay Beale
      organization Bastille Linux
    • name Jay Beale
      organization Bastille Linux
    • name Thomas R. Jones
      organization Maitreya Security
    description Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.
    family unix
    id oval:org.mitre.oval:def:2
    status accepted
    submitted 2003-08-18T12:00:00.000-04:00
    title Mutt BO Vulnerability in balsa
    version 38
  • accepted 2007-04-25T19:52:30.758-04:00
    class vulnerability
    contributors
    • name Jay Beale
      organization Bastille Linux
    • name Thomas R. Jones
      organization Maitreya Security
    description Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.
    family unix
    id oval:org.mitre.oval:def:434
    status accepted
    submitted 2003-08-18T12:00:00.000-04:00
    title Mutt BO Vulnerability
    version 38
redhat via4
advisories
rhsa
id RHSA-2003:109
refmap via4
bid 7120
bugtraq
  • 20030319 mutt-1.4.1 fixes a buffer overflow.
  • 20030320 CORE-20030304-02: Vulnerability in Mutt Mail User Agent
  • 20030320 [OpenPKG-SA-2003.025] OpenPKG Security Advisory (mutt)
  • 20030322 GLSA: mutt (200303-19)
  • 20030430 GLSA: balsa (200304-10)
conectiva
  • CLA-2003:626
  • CLA-2003:630
debian DSA-268
gentoo GLSA-200303-19
mandrake MDKSA-2003:041
misc http://www.coresecurity.com/common/showdoc.php?idx=310&idxseccion=10
suse SuSE-SA:2003:020
xf mutt-folder-name-bo(11583)
Last major update 11-10-2017 - 01:29
Published 24-03-2003 - 05:00
Last modified 11-10-2017 - 01:29
Back to Top