openSUSE-SU-2026:21016-1
openSUSE-SU-2026:21016-1 · Security update for mutt
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for mutt fixes the following issues - CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897). - CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896). - CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895). - CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894). - CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893). - CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).
Fix available
- Published
- Updated
Stack: system
Affected products and versions
mutt openSUSE:Leap 16.0
- Affected ranges
- ECOSYSTEM: < 2.2.16-160000.2.1
Update to 2.2.16-160000.2.1
Original sources
- https://bugzilla.suse.com/1263892
- https://bugzilla.suse.com/1263893
- https://bugzilla.suse.com/1263894
- https://bugzilla.suse.com/1263895
- https://bugzilla.suse.com/1263896
- https://bugzilla.suse.com/1263897
- https://bugzilla.suse.com/1264047
- https://www.suse.com/security/cve/CVE-2026-43859
- https://www.suse.com/security/cve/CVE-2026-43860
- https://www.suse.com/security/cve/CVE-2026-43861
- https://www.suse.com/security/cve/CVE-2026-43862
- https://www.suse.com/security/cve/CVE-2026-43863
- https://www.suse.com/security/cve/CVE-2026-43864
- https://osv.dev/vulnerability/openSUSE-SU-2026:21016-1