Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mutt for openSUSE:Factory checked in at 2026-10-09 21:45:58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mutt (Old) and /work/SRC/openSUSE:Factory/.mutt.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mutt" Fri Oct 9 21:45:58 2026 rev:127 rq:1383711 version:2.4.2 Changes: -------- --- /work/SRC/openSUSE:Factory/mutt/mutt.changes 2026-09-14 16:26:06.011921163 +0200 +++ /work/SRC/openSUSE:Factory/.mutt.new.3698736/mutt.changes 2026-10-09 21:47:06.073655140 +0200 @@ -1,0 +2,6 @@ +Fri Oct 9 08:20:33 UTC 2026 - Dr. Werner Fink <[email protected]> + +- Add patch bsc1284739-CVE-2026-107570.patch + * Fix bsc#1284739 (CVE-2026-107570) + +------------------------------------------------------------------- New: ---- bsc1284739-CVE-2026-107570.patch ----------(New B)---------- New: - Add patch bsc1284739-CVE-2026-107570.patch * Fix bsc#1284739 (CVE-2026-107570) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mutt.spec ++++++ --- /var/tmp/diff_new_pack.RWut4R/_old 2026-10-09 21:47:07.236704081 +0200 +++ /var/tmp/diff_new_pack.RWut4R/_new 2026-10-09 21:47:07.241704291 +0200 @@ -55,6 +55,8 @@ Patch18: mutt-1.5.21-mailcap.diff # PATCH-FIX-SUSE: bsc#907453 - CVE-2014-9116: mutt: heap-based buffer overflow in mutt_substrdup() Patch19: bsc907453-CVE-2014-9116-jessie.patch +# PATCH-FIX-UPSTREAM: bsc#128473 - CVE-2026-107570: mutt: heap out-of-bounds write in `convert_file_from_to()` via a crafted `Content-Type` header +Patch20: bsc1284739-CVE-2026-107570.patch # PATCH-ENHANCE-SUSE: boo#1156477 - Mutt has an option to ask before quitting on ^C but quits immediately on ^4 Patch21: mutt-Fix-SIGQUIT-handling.patch BuildRequires: autoconf @@ -161,7 +163,8 @@ %patch -P 15 -b .widechar.sidebar %patch -P 16 -b .crlf %patch -P 18 -b .mailcap -%patch -P 19 -b .cvw2014.9116 +%patch -P 19 -b .cve2014.9116 +%patch -P 20 -p1 -b .cve2026.107570 %patch -P 21 -b .quit cp %{SOURCE2} . ++++++ bsc1284739-CVE-2026-107570.patch ++++++ >From 7752d93f26f8f1384905fad874afff5abb0f3e54 Mon Sep 17 00:00:00 2001 From: "Kevin J. McCarthy" <[email protected]> Date: Tue, 6 Oct 2026 13:50:42 +0800 Subject: [PATCH] Fix OOB heap write in convert_file_from_to(). This issue was reported by Calif.io, in collaboration with Anthropic, with a full reproduce and suggested patch. I've reviewed the patch and concur it is the best approach. This is due to a logic error in convert_file_from_to() in sendlib.c. It first counts the number of charsets to try in one loop, and then allocates and copies the charsets over in a separate loop afterwards. Unfortunately the second loop's logic does not follow the first loop exactly, and the counter gets out of sync with a zero-length charset. For example ":utf-8" where ":" is the delimiter. The fix is to keep the counter logic the same: incrementing after the initial zero-length charset check instead of in the for loop increment clause. It takes user interaction to trigger this OOB write: using the received message as a template in a new message via <resend-message>. The write is of arbitrary length. Calif.io did not report any exploitation beyond the OOB write. Nonetheless, I recommend all shipping distributions apply this patch. --- sendlib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sendlib.c b/sendlib.c index de6aa542..49d81400 100644 --- a/sendlib.c +++ b/sendlib.c @@ -864,11 +864,11 @@ static size_t convert_file_from_to(FILE *file, /* Copy them */ tcode = safe_malloc(ncodes * sizeof(char *)); - for (c = tocodes, i = 0; c; c = c1 ? c1 + 1 : 0, i++) + for (c = tocodes, i = 0; c; c = c1 ? c1 + 1 : 0) { if ((c1 = strchr(c, ':')) == c) continue; - tcode[i] = mutt_substrdup(c, c1); + tcode[i++] = mutt_substrdup(c, c1); } ret = (size_t)(-1); -- GitLab
