| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: mutt | Distribution: openSUSE Tumbleweed |
| Version: 2.4.3 | Vendor: openSUSE |
| Release: 1.1 | Build date: Wed Oct 28 14:25:33 2026 |
| Group: Productivity/Networking/Email/Clients | Build host: reproducible |
| Size: 1945923 | Source RPM: mutt-2.4.3-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: http://www.mutt.org | |
| Summary: Mail Program | |
A very powerful mail user agent. It supports (among other nice things) highlighting, threading, and PGP. It takes some time to get used to, however. This version is based on NeoMutt, that is it includes many enhancements.
GPL-2.0-or-later
* Wed Oct 28 2026 Dr. Werner Fink <werner@suse.de>
- Update to mutt 2.4.3 (Bug fix release)
* Fix OOB heap write in convert_file_from_to().
This issue was reported by Calif.io, in collaboration with Anthropic,
with a full reproduce and suggested patch. I've reviewed the patch
and concur it is the best approach.
This is due to a logic error in convert_file_from_to() in sendlib.c.
It first counts the number of charsets to try in one loop, and then
allocates and copies the charsets over in a separate loop afterwards.
Unfortunately the second loop's logic does not follow the first loop
exactly, and the counter gets out of sync with a zero-length charset.
For example ":utf-8" where ":" is the delimiter.
The fix is to keep the counter logic the same: incrementing after the
initial zero-length charset check instead of in the for loop increment
clause.
It takes user interaction to trigger this OOB write: using the
received message as a template in a new message via <resend-message>.
The write is of arbitrary length.
Calif.io did not report any exploitation beyond the OOB write.
Nonetheless, I recommend all shipping distributions apply this patch.
* Fix mutt_signed_handler() goodsig setting.
The signed handler did not properly handle the case where
crypt_write_signed() fails, or the case where an unknown signature
type is encountered. In both those cases, goodsig would be left as 1,
giving a status flag in the index as 'S', indicating a goodsig.
Thanks to Acts1631 for the ticket, with a detailed description of the
problem and suggested fix, which this patch is based on.
- Remove patch bsc1284739-CVE-2026-107570.patch
as the above mentioned fix for convert_file_from_to() is fixed now
* Fri Oct 09 2026 Dr. Werner Fink <werner@suse.de>
- Add patch bsc1284739-CVE-2026-107570.patch
* Fix bsc#1284739 (CVE-2026-107570)
* Mon Sep 14 2026 Dominique Leuenberger <dleuenberger@suse.com>
- Use https://ftp.osuosl.org to download assets: ftp.mutt.org is an
alias, but without valid ssl certs.
- Use http://www.mutt.org as URL: there is no valid cert to
advertise https:// to the users.
* Tue Sep 08 2026 Dr. Werner Fink <werner@suse.de>
- Use ftp instead of https for ftp.mutt.org
* Mon Sep 07 2026 Dr. Werner Fink <werner@suse.de>
- Update to mutt 2.4.2 (Bug fix release)
* This is a bug-fix release, fixing several small issues, including
a sporadic compose-menu prompt to update attachment encoding
occurring with recent Linux kernels
* 2.4.1 was a bug-fix release, fixing compilation with OpenSSL 4,
Alt keybindings in the foot terminal, a minor crash bug, and a
theoretical IMAP overflow bug. See the UPDATING file for more details.
* 2.4.0 was release that has new features and bug fixes.
See the UPDATING file, or for more details see the release notes page.
* 2.3.3 was a bug-fix release, fixing a crash bug for deeply nested
message types and a configure bug for the bundled-regex option.
* Mon Sep 07 2026 Dr. Werner Fink <werner@suse.de>
- Fix python macro usage
* Tue May 05 2026 Dr. Werner Fink <werner@suse.de>
- Update to mutt 2.3.2 (Bug fix release)
* Mutt 2.3.2 was released on April 26, 2026.
It is a bug-fix release, fixing an assortment of issues,
including a possible NULL dereference in the GPGME code.
* Mutt 2.3.1 was released on March 20, 2026.
It is a bug-fix release, fixing a build issue when configured
- -without-wc-funcs, and a bug in the folder browser.
* Mutt 2.3.0 was released on January 25, 2026.
It release has new features and bug fixes.
+ $socket_receive_timeout and $socket_send_timeout cause mutt to
timeout on a network read/write operation, respectively. These
could be useful if you have an unreliable connection and
frequently find mutt gets stuck in a read.
! The folder browser now differentiates browsing for a file versus a
mailbox. For IMAP users, this means when attaching a file to an
email, mutt will browse your local computer by default.
! <edit-label> no longer untags messages. This is consistent with
other operations inside of mutt.
+ $imap_reconnect_tries and $imap_reconnect_sleep control the number
of times mutt will try to reconnect when a connection is lost, and
how long to sleep between each retry.
- Upgrading from Mutt 2.2.16 to 2.3.2 is a critical security jump to
fix the bugs boo#1263892, boo#1263893, boo#1263894, boo#1263895,
boo#1263896, and boo#1263897:
* CVE-2026-43862: Fixes a NULL pointer dereference in the GPGME
signature summary code that could crash the application.
* CVE-2026-43863 & CVE-2026-43864: Prevents crashes and potential
memory issues when handling IMAP AUTH-CRAM MD5 authentication.
* CVE-2026-43861 & CVE-2026-43860: Addresses issues with embedded
NUL characters in URL decoding, which could lead to bypasses or crashes.
* CVE-2026-43859: Fixes a security level size check in GSSAPI
authentication to prevent buffer-related errors.
- Remove mutt-1.10.1-imap.patch as it seems to solved upstream now
* Wed Jan 21 2026 Dr. Werner Fink <werner@suse.de>
- In Leap 15.5/15.7 latest postfix is currently broken, let's
try to skip smtp_daemon build reqirement
* Thu Jan 15 2026 Dr. Werner Fink <werner@suse.de>
- Remove dependency on update-desktop-files (jsc#PED-15228)
* Sat Nov 22 2025 olaf@aepfle.de
- Update to mutt 2.2.16 (Bug fix release)
* fixing an IMAP search/limit bug
* Thu Aug 07 2025 Dr. Werner Fink <werner@suse.de>
- Exclude sample ca-bundle.crt as it is outdated (bsc#1246321)
* Wed May 21 2025 Dr. Werner Fink <werner@suse.de>
- Update to mutt 2.2.14 (Bug fix release)
* fixing a couple possible crashes, in GPGME and with IMAP when
logging out
* and correcting a small issue with unnecessary encoding of "."
in attachment names (2231 encoding).
- Make doc info and hmtl file build without network
- Set default mail spool files
* Mon Jul 15 2024 Dr. Werner Fink <werner@suse.de>
- Remove patch aw.listreply.diff as it conflicts with builtin
<list-reply> feature
- Build and install pdf doc
* Mon Jul 15 2024 Dr. Werner Fink <werner@suse.de>
- Require some cyrus-sasl plugins to make the cyrus-sasl feature
of mutt function (boo#1227731)
* Mon Jun 03 2024 Dr. Werner Fink <werner@suse.de>
- Update to mutt 2.2.13 (Bug fix release)
* Fix smtp client to respect $use_envelope_from option. The code
was only looking to see if $envelope_from_address had a value,
not if $use_envelope_from was set.
Add extra safety checks to make sure the mailbox value isn't NULL.
* Fix smtp client $envelope_from_address possible dangling pointer.
If the account-hook invoked by mutt_conn_find() modifies
$envelope_from_address, envfrom could point no longer point to the
address.
Move the mutt_conn_find() before the code that determines the envelope
from address.
* Fri Feb 23 2024 pgajdos@suse.com
- Use %patch -P N instead of deprecated %patchN.
* Tue Feb 20 2024 Dr. Werner Fink <werner@suse.de>
- Only suggest smtp daemon at runtime. Nevertheless if not
installed user will face a a warning.
- Move /etc/Muttrc to /usr/share/mutt/Muttrc
* Mon Oct 09 2023 Dr. Werner Fink <werner@suse.de>
- Require a smtp daemon at build and runtime to work around
missing system /var/mail/ directory (boo#1216035)
* Wed Sep 27 2023 Dr. Werner Fink <werner@suse.de>
- Submit latest mutt 2.2.12 to SLE-15-SP6 for jira#PED-5580
* Drop patches for boo#1172906, boo#1172935, CVE-2020-14093,
and CVE-2020-14154 now upstream
- 3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01.patch
+ Prevent possible IMAP MITM via PREAUTH response.
- mutt-1.10.1-backport-mutt_ssl_gnutls-1.14.3.dif
to port mutt_ssl_gnutls.c from mutt 1.14.3 back
+ expired certs not properly rejected with GnuTLS
+ Side effect is support of TLSv1_3 is supported by gnutls
* Drop patch for bsc#1173197 c547433cdf2e79191b15c6932c57f1472bfb5ff4.dif
now upstream
- Fix CVE-2020-14954: STARTTLS buffering issue allowing man
in the middle attack of IMAP, SMTP and POP3
* Drop patch for bsc#1179035, CVE-2020-28896.patch now upstream
- incomplete connection termination could lead to sending
credentials over unencrypted connections
* Drop patch for bsc#1179113 and boo#1179461 nofreeze-c72f740a.patch
now upstream
- Avoid that message with a million tiny parts can freeze MUA
for several minutes
* Drop patch for bsc#1181221, CVE-2021-3181 mutt-colon.patch now
upstream
- recipient parsing memory leak. This patch combines three
smaller commits
* Drop patch for bsc#1198518, CVE-2022-1328 uudecode-e5ed080c.patch
- fix a buffer overflow in uudecoder
* Drop patches now upstream
- CVE-2023-4874-part1.patch (bsc#1215189 for CVE-2023-4874)
- CVE-2023-4874-part2.patch (bsc#1215189 for CVE-2023-4874)
- CVE-2023-4875.patch (bsc#1215191 for CVE-2023-4875)
* Tue Sep 12 2023 Dr. Werner Fink <werner@suse.de>
- Update to mutt 2.2.12 (bsc#1215189 for CVE-2023-4874,
bsc#1215191 for CVE-2023-4875)
* 2.2.12 (2023-09-09):
Bug fix release.
* 2.2.11 (2023-08-18):
Bug fix release.
* Mon Apr 17 2023 Dr. Werner Fink <werner@suse.de>
- Use astrix instead of german u umlaut as point
* Mon Apr 03 2023 Dirk Müller <dmueller@suse.com>
- update to 2.2.10:
* Bug fix release.
* $message_id_format %r and %z expandos use a URL-safe Base64 encoding:
'-' and '_' instead of '+' and '/'.
/etc/skel/.muttrc /usr/bin/Signature_conversion /usr/bin/mutt /usr/bin/mutt_pgpring /usr/bin/pgpewrap /usr/bin/smime_keys /usr/share/applications/mutt.desktop /usr/share/doc/packages/mutt /usr/share/doc/packages/mutt/manual.txt.gz /usr/share/doc/packages/mutt/mutt_oauth2.py /usr/share/doc/packages/mutt/mutt_oauth2.py.README /usr/share/man/man1/mutt.1.gz /usr/share/man/man1/mutt_pgpring.1.gz /usr/share/man/man1/pgpewrap.1.gz /usr/share/man/man1/smime_keys.1.gz /usr/share/man/man5/mbox_mutt.5.gz /usr/share/man/man5/mmdf_mutt.5.gz /usr/share/man/man5/muttrc.5.gz /usr/share/mutt /usr/share/mutt/Muttrc /usr/share/mutt/mailcap /usr/share/pixmaps/mutt.png
Generated by rpm2html 1.8.1
Fabrice Bellet, Thu Oct 29 23:33:48 2026