CVE-2018-14355

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-14355
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14355.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-14355
Downstream
Related
Published
2018-07-17T17:29:00Z
Modified
2025-10-10T01:17:40.372349Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.

References

Affected packages

Git / github.com/muttmua/mutt

Affected ranges

Type
GIT
Repo
https://github.com/muttmua/mutt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ed9d7727dc705754871e31cb41420f0ea956495b
Type
GIT
Repo
https://github.com/neomutt/neomutt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57971dba06346b2d7179294f4528b8d4427a7c5d
Type
GIT
Repo
https://gitlab.com/muttmua/mutt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
31eef6c766f47df8281942d19f76e35f475c781d

Affected versions

Other

mutt-0-92-10i
mutt-0-92-11i
mutt-0-92-9i
mutt-0-93-unstable
mutt-0-94-10i-rel
mutt-0-94-13-rel
mutt-0-94-14-rel
mutt-0-94-15-rel
mutt-0-94-16i-rel
mutt-0-94-17i-rel
mutt-0-94-18-rel
mutt-0-94-5i-rel
mutt-0-94-6i-rel
mutt-0-94-7i-rel
mutt-0-94-8i-rel
mutt-0-94-9i-p1
mutt-0-94-9i-rel
mutt-0-95-rel
mutt-0-96-1-rel
mutt-0-96-2-slightly-post-release
mutt-0-96-3-rel
mutt-0-96-4-rel
mutt-0-96-5-rel
mutt-0-96-6-rel
mutt-0-96-7-rel
mutt-0-96-8-rel
mutt-0-96-rel
mutt-1-1-1-1-rel
mutt-1-1-1-2-rel
mutt-1-1-1-rel
mutt-1-1-10-rel
mutt-1-1-11-rel
mutt-1-1-12-rel
mutt-1-1-13-rel
mutt-1-1-14-rel
mutt-1-1-2-rel
mutt-1-1-3-rel
mutt-1-1-4-rel
mutt-1-1-5-rel
mutt-1-1-6-rel
mutt-1-1-7-rel
mutt-1-1-8-rel
mutt-1-1-9-rel
mutt-1-1-rel
mutt-1-10-rel
mutt-1-3-1-rel
mutt-1-3-10-rel
mutt-1-3-11-rel
mutt-1-3-12-rel
mutt-1-3-13-rel
mutt-1-3-14-rel
mutt-1-3-15-rel
mutt-1-3-16-rel
mutt-1-3-17-rel
mutt-1-3-18-rel
mutt-1-3-19-rel
mutt-1-3-2-rel
mutt-1-3-20-rel
mutt-1-3-21-rel
mutt-1-3-22-1-rel
mutt-1-3-22-rel
mutt-1-3-23-1-rel
mutt-1-3-23-2-rel
mutt-1-3-23-rel
mutt-1-3-24-rel
mutt-1-3-25-rel
mutt-1-3-26-rel
mutt-1-3-27-rel
mutt-1-3-3-rel
mutt-1-3-4-rel
mutt-1-3-5-rel
mutt-1-3-6-rel
mutt-1-3-7-rel
mutt-1-3-8-rel
mutt-1-3-9-rel
mutt-1-3-rel
mutt-1-5-1-rel
mutt-1-5-10-rel
mutt-1-5-11-rel
mutt-1-5-12-rel
mutt-1-5-13-rel
mutt-1-5-14-rel
mutt-1-5-15-rel
mutt-1-5-16-rel
mutt-1-5-17-rel
mutt-1-5-18-rel
mutt-1-5-19-rel
mutt-1-5-2-rel
mutt-1-5-20-rel
mutt-1-5-21-rel
mutt-1-5-22-rel
mutt-1-5-23-rel
mutt-1-5-24-rel
mutt-1-5-3-rel
mutt-1-5-4-rel
mutt-1-5-5-1-rel
mutt-1-5-5-rel
mutt-1-5-6-rel
mutt-1-5-7-rel
mutt-1-5-8-rel
mutt-1-5-9-rel
mutt-1-6-1-rel
mutt-1-6-2-rel
mutt-1-6-rel
mutt-1-7-1-rel
mutt-1-7-2-rel
mutt-1-7-rel
mutt-1-8-1-rel
mutt-1-8-2-rel
mutt-1-8-3-rel
mutt-1-8-rel
mutt-1-9-1-rel
mutt-1-9-2-rel
mutt-1-9-3-rel
mutt-1-9-4-rel
mutt-1-9-5-rel
mutt-1-9-rel
neomutt-20160822
neomutt-20160827
neomutt-20160910
neomutt-20160916
neomutt-20161002
neomutt-20161003
neomutt-20161014
neomutt-20161028
neomutt-20161104
neomutt-20161126
neomutt-20170113
neomutt-20170128
neomutt-20170206
neomutt-20170225
neomutt-20170306
neomutt-20170414
neomutt-20170421
neomutt-20170428
neomutt-20170526
neomutt-20170602
neomutt-20170609
neomutt-20170707
neomutt-20170714
neomutt-20170907
neomutt-20170912
neomutt-20171006
neomutt-20171013
neomutt-20171027
neomutt-20171208
neomutt-20171215
neomutt-20180223
neomutt-20180323
neomutt-20180512
neomutt-20180622
post-type-punning-patch
pre-type-punning-patch

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "line_hashes": [
                    "141797331147250530911102648456595779174",
                    "2704004268200097547417893485547819295",
                    "273163297609346434882187086790240664951"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "imap/util.c"
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "id": "CVE-2018-14355-059f90cb",
            "source": "https://github.com/neomutt/neomutt/commit/57971dba06346b2d7179294f4528b8d4427a7c5d",
            "deprecated": false
        },
        {
            "digest": {
                "line_hashes": [
                    "305912007481164313825398694367915039689",
                    "269758642847245179727498025429580904529",
                    "195401893343723787680960476151785971447",
                    "72380641635660808060694716956251780362",
                    "141797331147250530911102648456595779174",
                    "2704004268200097547417893485547819295",
                    "97868484814233050309242126571929676450"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "imap/util.c"
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "id": "CVE-2018-14355-6299f1fd",
            "source": "https://gitlab.com/muttmua/mutt@31eef6c766f47df8281942d19f76e35f475c781d",
            "deprecated": false
        },
        {
            "digest": {
                "length": 566.0,
                "function_hash": "93499585419513541823634445214594359186"
            },
            "target": {
                "function": "imap_hcache_open",
                "file": "imap/util.c"
            },
            "signature_version": "v1",
            "signature_type": "Function",
            "id": "CVE-2018-14355-94bab218",
            "source": "https://gitlab.com/muttmua/mutt@31eef6c766f47df8281942d19f76e35f475c781d",
            "deprecated": false
        },
        {
            "digest": {
                "length": 560.0,
                "function_hash": "36220242076158421006655775108377330777"
            },
            "target": {
                "function": "imap_hcache_open",
                "file": "imap/util.c"
            },
            "signature_version": "v1",
            "signature_type": "Function",
            "id": "CVE-2018-14355-9f4ae404",
            "source": "https://github.com/neomutt/neomutt/commit/57971dba06346b2d7179294f4528b8d4427a7c5d",
            "deprecated": false
        }
    ]
}