Control: tags 1150407 + patch Control: tags 1150407 + pending
Dear maintainer, I've prepared an NMU for mutt (versioned as 2.4.1-1.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should cancel it. Regards, Salvatore
diffstat for mutt-2.4.1 mutt-2.4.1 changelog | 8 + patches/series | 1 patches/upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch | 54 ++++++++++ 3 files changed, 63 insertions(+) diff -Nru mutt-2.4.1/debian/changelog mutt-2.4.1/debian/changelog --- mutt-2.4.1/debian/changelog 2026-07-21 07:46:27.000000000 +0200 +++ mutt-2.4.1/debian/changelog 2026-10-25 15:12:45.000000000 +0100 @@ -1,3 +1,11 @@ +mutt (2.4.1-1.1) unstable; urgency=medium + + * Non-maintainer upload. + * Fix OOB heap write in convert_file_from_to(). (CVE-2026-107570) + (Closes: #1150407) + + -- Salvatore Bonaccorso <[email protected]> Sun, 25 Oct 2026 15:12:45 +0100 + mutt (2.4.1-1) unstable; urgency=medium * New upstream release (Closes: 1072814, 1113796, 1141601). diff -Nru mutt-2.4.1/debian/patches/series mutt-2.4.1/debian/patches/series --- mutt-2.4.1/debian/patches/series 2026-07-21 07:46:27.000000000 +0200 +++ mutt-2.4.1/debian/patches/series 2026-10-25 15:11:49.000000000 +0100 @@ -12,3 +12,4 @@ upstream/1125291-fix-smime_pk7out_command-for-key-extraction.patch upstream/787968-muttrc-man-grammar-fix.patch upstream/shellcheck-errors.patch +upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch diff -Nru mutt-2.4.1/debian/patches/upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch mutt-2.4.1/debian/patches/upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch --- mutt-2.4.1/debian/patches/upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch 1970-01-01 01:00:00.000000000 +0100 +++ mutt-2.4.1/debian/patches/upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch 2026-10-25 15:11:18.000000000 +0100 @@ -0,0 +1,54 @@ +From: "Kevin J. McCarthy" <[email protected]> +Date: Tue, 6 Oct 2026 13:50:42 +0800 +Subject: Fix OOB heap write in convert_file_from_to(). +Origin: https://gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54 +Bug-Debian: https://bugs.debian.org/1150407 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-107570 + +This issue was reported by Calif.io, in collaboration with Anthropic, +with a full reproduce and suggested patch. I've reviewed the patch +and concur it is the best approach. + +This is due to a logic error in convert_file_from_to() in sendlib.c. +It first counts the number of charsets to try in one loop, and then +allocates and copies the charsets over in a separate loop afterwards. + +Unfortunately the second loop's logic does not follow the first loop +exactly, and the counter gets out of sync with a zero-length charset. +For example ":utf-8" where ":" is the delimiter. + +The fix is to keep the counter logic the same: incrementing after the +initial zero-length charset check instead of in the for loop increment +clause. + +It takes user interaction to trigger this OOB write: using the +received message as a template in a new message via <resend-message>. +The write is of arbitrary length. + +Calif.io did not report any exploitation beyond the OOB write. +Nonetheless, I recommend all shipping distributions apply this patch. +--- + sendlib.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sendlib.c b/sendlib.c +index de6aa542b3c8..49d814000e33 100644 +--- a/sendlib.c ++++ b/sendlib.c +@@ -864,11 +864,11 @@ static size_t convert_file_from_to(FILE *file, + + /* Copy them */ + tcode = safe_malloc(ncodes * sizeof(char *)); +- for (c = tocodes, i = 0; c; c = c1 ? c1 + 1 : 0, i++) ++ for (c = tocodes, i = 0; c; c = c1 ? c1 + 1 : 0) + { + if ((c1 = strchr(c, ':')) == c) + continue; +- tcode[i] = mutt_substrdup(c, c1); ++ tcode[i++] = mutt_substrdup(c, c1); + } + + ret = (size_t)(-1); +-- +2.55.0 +
