Your message dated Tue, 27 Oct 2026 14:52:09 +0000
with message-id <[email protected]>
and subject line Bug#1150407: fixed in mutt 2.4.1-1.1
has caused the Debian Bug report #1150407,
regarding mutt: CVE-2026-107570
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150407: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150407
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mutt
Version: 2.4.1-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Forwarded: https://gitlab.com/muttmua/mutt/-/work_items/533
Hi,
The following vulnerability was published for mutt.
CVE-2026-107570[0]:
| heap OOB write in convert_file_from_to() via a crafted Content-Type
| header allows attacker to OOB write when email is used as a
| template.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-107570
https://www.cve.org/CVERecord?id=CVE-2026-107570
[1] https://gitlab.com/muttmua/mutt/-/work_items/533
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: mutt
Source-Version: 2.4.1-1.1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
mutt, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated mutt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 25 Oct 2026 15:12:45 +0100
Source: mutt
Architecture: source
Version: 2.4.1-1.1
Distribution: unstable
Urgency: medium
Maintainer: Mutt maintainers <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1150407
Changes:
mutt (2.4.1-1.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Fix OOB heap write in convert_file_from_to(). (CVE-2026-107570)
(Closes: #1150407)
Checksums-Sha1:
4916e123828d71ecc2742be7296eea7be337ee5e 2452 mutt_2.4.1-1.1.dsc
a7a3388a1f6d8db0fa84e253c6e566d06e4e2305 57368 mutt_2.4.1-1.1.debian.tar.xz
2d5b05cdb81f61b85bfb8c8fc2372ea852366c1b 5529 mutt_2.4.1-1.1_source.buildinfo
Checksums-Sha256:
8f0761a7a5edcb81977c82dbaec4d5f21df0c918ce42e13589c4e5614d6b7b38 2452
mutt_2.4.1-1.1.dsc
c4db5f6c711da9ae8ac49723aa8f7d3690adbf3afb9dbf30c38b5e96778fa332 57368
mutt_2.4.1-1.1.debian.tar.xz
aefdd333e36ddfa60de363989440ba5324214e7b5fbaf1b1183e6dc486e68f95 5529
mutt_2.4.1-1.1_source.buildinfo
Files:
470828a4126f87c75d5442f83ac2175e 2452 mail optional mutt_2.4.1-1.1.dsc
a69ec24332ce7de2a1df35263cfa6f74 57368 mail optional
mutt_2.4.1-1.1.debian.tar.xz
4d5acd7ca9fc0af61f3156a2a1337a30 5529 mail optional
mutt_2.4.1-1.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmreEjZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E7pIP/RtxfUq1KT/kLH0GvvzBfg9kkR56K7Le
ftTSIOHr75c7/Lm2T6ITKa41rslXkshLnmMn12w70umI9a2veH1yocqO0aTmzoUF
HUOwiMCu80mCboiJP/JtGWYSh41FXDsvNWhlU/6/Iq12RvHNzmsfFTm2OdewJqpZ
Ger2Jt+/n5PqIzudK1RiI3e07PWL8z7o49YePo2NY02Oe8blm/Eyv1uzvM+mBCuV
9r7YwOWfULekojNkGFJDIeWsWc/SvkaKO/ScZ7RrPQcAVgt2dQDlXd/I2a82tk3v
coSS66ikEFhOd9CsImT4B9XKeVS2Yoy+1LvxuGxRtQXnUvKIUHKHRttv5MxIHZPW
9uR4vehUut75aE6G4iI5oFwuiMm6HvGEIEXbRFfTtvV1HSjTsjwqa2Mlxc9o3qg0
wFixbMbXNoTOJwDYnF8UjaLdbR5StKuc3YHsCPjSabcu25Pd1C5w4Dh5d38fqdrq
NCgOSiZYXV26lPe96UTzm5S8fn7dhOBUXrBEts4Zt5IkPGiGwoIuSsu3Rk5rwJMy
L/xEvP/tsI5Rqk/3M0dFNTZlYpPpVHsTO9JyqDaiPQ/IyHkTfTPmco80Rbxd3/Fa
ka9viR+19KUDxBLXdYZP/eH50vMrkOcCJ8CtGbXQrAc1ffeiflKydnT/BQsBNXT+
OhmuBzLQ9kz3
=2Qt0
-----END PGP SIGNATURE-----
pgpGmHXszoHI6.pgp
Description: PGP signature
--- End Message ---
