openSUSE-SU-2026:21016-1
openSUSE-SU-2026:21016-1 · Security update for mutt
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
This update for mutt fixes the following issues - CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897). - CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896). - CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895). - CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894). - CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893). - CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
mutt openSUSE:Leap 16.0
- Plages de versions concernées
- ECOSYSTEM: < 2.2.16-160000.2.1
Mettez à jour vers 2.2.16-160000.2.1
Sources originales
- https://bugzilla.suse.com/1263892
- https://bugzilla.suse.com/1263893
- https://bugzilla.suse.com/1263894
- https://bugzilla.suse.com/1263895
- https://bugzilla.suse.com/1263896
- https://bugzilla.suse.com/1263897
- https://bugzilla.suse.com/1264047
- https://www.suse.com/security/cve/CVE-2026-43859
- https://www.suse.com/security/cve/CVE-2026-43860
- https://www.suse.com/security/cve/CVE-2026-43861
- https://www.suse.com/security/cve/CVE-2026-43862
- https://www.suse.com/security/cve/CVE-2026-43863
- https://www.suse.com/security/cve/CVE-2026-43864
- https://osv.dev/vulnerability/openSUSE-SU-2026:21016-1