Package: mutt Version: 2.0.5-4 Severity: normal Tags: upstream fixed-upstream Forwarded: https://gitlab.com/muttmua/mutt/-/issues/345
When mutt is run with the standard input not attached to a terminal and without an e-mail address as an argument, it sends a mail, while the help text requires at least an address in argument (which makes sense). For instance: echo foo | mutt When there are no default recipients, one gets an error, but when there are default recipients (via my_hdr), a mail is really sent, with the contents of the standard input (in the example, "foo"). As sending a mail is not expected in this case, this might be a security issue (even if the recipient addresses belong to the user). -- Package-specific info: Mutt 2.0.6+144 (4e01ccdb) vl-132933 (2021-03-28) Copyright (C) 1996-2021 Michael R. Elkins and others. Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'. Mutt is free software, and you are welcome to redistribute it under certain conditions; type `mutt -vv' for details. System: Linux 5.10.0-5-amd64 (x86_64) ncurses: ncurses 6.2.20201114 (compiled with 6.2) libidn: 1.33 (compiled with 1.33) Compiler: Using built-in specs. COLLECT_GCC=gcc COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/10/lto-wrapper OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa:hsa OFFLOAD_TARGET_DEFAULT=1 Target: x86_64-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Debian 10.2.1-6' --with-bugurl=file:///usr/share/doc/gcc-10/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,m2 --prefix=/usr --with-gcc-major-version-only --program-suffix=-10 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --enable-default-pie --with-system-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none=/build/gcc-10-Km9U7s/gcc-10-10.2.1/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-10-Km9U7s/gcc-10-10.2.1/debian/tmp-gcn/usr,hsa --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu --with-build-config=bootstrap-lto-lean --enable-link-mutex Thread model: posix Supported LTO compression algorithms: zlib zstd gcc version 10.2.1 20210110 (Debian 10.2.1-6) Configure options: '--prefix=/home/vinc17' '--enable-debug' '--enable-pop' '--enable-imap' '--with-ssl' '--enable-compressed' '--with-exec-shell=/home/vinc17/bin/sh.screen' '--enable-gpgme' '--with-system-dotlock=/usr/bin/mutt_dotlock' 'CC=gcc' 'CFLAGS=-g -O3 -march=native -fsanitize=undefined -fno-sanitize-recover' Compilation CFLAGS: -Wall -pedantic -Wno-long-long -g -O3 -march=native -fsanitize=undefined -fno-sanitize-recover Compile options: -DOMAIN +DEBUG -HOMESPOOL +USE_SETGID +USE_DOTLOCK +DL_STANDALONE +USE_FCNTL -USE_FLOCK +USE_POP +USE_IMAP -USE_SMTP +USE_SSL_OPENSSL -USE_SSL_GNUTLS -USE_SASL -USE_GSS +HAVE_GETADDRINFO +HAVE_REGCOMP -USE_GNU_REGEX +HAVE_COLOR +HAVE_START_COLOR +HAVE_TYPEAHEAD +HAVE_BKGDSET +HAVE_CURS_SET +HAVE_META +HAVE_RESIZETERM +HAVE_FUTIMENS +CRYPT_BACKEND_CLASSIC_PGP +CRYPT_BACKEND_CLASSIC_SMIME +CRYPT_BACKEND_GPGME -EXACT_ADDRESS -SUN_ATTACHMENT +ENABLE_NLS -LOCALES_HACK +HAVE_WC_FUNCS +HAVE_LANGINFO_CODESET +HAVE_LANGINFO_YESEXPR +HAVE_ICONV -ICONV_NONTRANS +HAVE_LIBIDN -HAVE_LIBIDN2 +HAVE_GETSID -USE_HCACHE -USE_SIDEBAR +USE_COMPRESSED +USE_INOTIFY ISPELL="/usr/bin/ispell" SENDMAIL="/usr/sbin/sendmail" MAILPATH="/var/mail" PKGDATADIR="/home/vinc17/share/mutt" SYSCONFDIR="/home/vinc17/etc" EXECSHELL="/home/vinc17/bin/sh.screen" -MIXMASTER To contact the developers, please mail to <[email protected]>. To report a bug, please contact the Mutt maintainers via gitlab: https://gitlab.com/muttmua/mutt/issues patch-20200424.vl.pretty_size.1 patch-20200505.vl.simplesearchkw.1 patch-20200424.pdmef.progress.vl.1 patch-20201129.vl.address_all_patt.1 patch-20201130.tamovl.sysdotlock.1 -- System Information: Debian Release: bullseye/sid APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'testing-security'), (500, 'stable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-5-amd64 (SMP w/8 CPU threads) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=POSIX, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages mutt depends on: ii libc6 2.31-10 ii libgnutls30 3.7.1-1 ii libgpg-error0 1.38-2 ii libgpgme11 1.14.0-1+b2 ii libgssapi-krb5-2 1.18.3-4 ii libidn2-0 2.3.0-5 ii libncursesw6 6.2+20201114-2 ii libsasl2-2 2.1.27+dfsg-2.1 ii libtinfo6 6.2+20201114-2 ii libtokyocabinet9 1.4.48-13 ii zlib1g 1:1.2.11.dfsg-2 Versions of packages mutt recommends: ii libsasl2-modules 2.1.27+dfsg-2.1 ii locales 2.31-10 ii mime-support 3.66 ii sensible-utils 0.0.14 Versions of packages mutt suggests: ii aspell 0.60.8-2 ii ca-certificates 20210119 ii gnupg 2.2.27-1 ii ispell 3.4.02-2 pn mixmaster <none> ii openssl 1.1.1k-1 ii postfix [mail-transport-agent] 3.5.6-1 ii urlview 0.9-21+b1 Versions of packages mutt is related to: ii mutt 2.0.5-4 -- no debconf information -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
