Mutt 1.5.20

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:mutt:mutt:1.5.20:*:*:*:*:*:*:*

part: a version: 1.5.20 update: *

VendorMutt (8d049cd7-bc69-5f44-93e6-1dbaf65270ac)
ProductMutt (ed9771c9-1df1-58ed-87e5-c8d9add0ea56)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:bitbucket/mutt/mutt purl2cpe 2026-06-01 10:11:48.383412
pkg:deb/debian/mutt purl2cpe 2026-06-01 10:11:48.383414
pkg:deb/ubuntu/mutt purl2cpe 2026-06-01 10:11:48.383415
pkg:github/muttmua/mutt purl2cpe 2026-06-01 10:11:48.383416
pkg:gitlab/muttmua/mutt purl2cpe 2026-06-01 10:11:48.383418
pkg:rpm/fedora/mutt purl2cpe 2026-06-01 10:11:48.383419

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2014-0467 vulnerable 2026-06-08 05:05:12.905640 Details available
Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.
Published: 2014-03-14T15:00:00.000Z
Updated: 2024-08-06T09:20:17.952Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3765 vulnerable 2026-06-08 04:51:44.159445 Details available
mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Published: 2009-10-23T19:00:00.000Z
Updated: 2024-09-16T20:22:26.580Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.