CVE-2021-32055
Fixed in a distro release EPSS 3%
Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | mutt | 2.0.7-1 |
| Arch Linux | neomutt | 20211015-1 |
| Debian 12 | mutt | 2.0.5-4.1 |
| Debian 12 | neomutt | 20201127+dfsg.1-1.2 |
| Debian 13 | mutt | 2.0.5-4.1 |
| Debian 13 | neomutt | 20201127+dfsg.1-1.2 |
| Debian 14 | mutt | 2.0.5-4.1 |
| Debian 14 | neomutt | 20201127+dfsg.1-1.2 |
| SUSE Package Hub 15 SP4 | neomutt | 20220429-bp154.2.3.1 |
| Ubuntu 18.04 LTS | mutt | 1.9.4-3ubuntu0.6 |
| Ubuntu 20.04 LTS | mutt | 1.13.2-1ubuntu0.5 |
| Ubuntu 22.04 LTS | mutt | 2.1.4-1ubuntu1.1 |
| Ubuntu Pro 16.04 LTS | mutt | 1.5.24-1ubuntu0.6+esm2 |
| Ubuntu Pro 18.04 LTS | neomutt | 20171215+dfsg.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | neomutt | 20191207+dfsg.1-1.1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | neomutt | 20211029+dfsg1-1ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | neomutt | 20231103+dfsg1-1ubuntu0.1~esm1 |
| openSUSE Leap 15.4 | neomutt | 20220429-bp154.2.3.1 |
| openSUSE Tumbleweed | mutt | 2.0.7-2.2 |
| openSUSE Tumbleweed | neomutt | 20211029-1.1 |