CVE-2006-3242

Description

Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 6.30% Top 10%

Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory trustix.org Vendor Advisory slackware.com Vendor Advisory openpkg.org Vendor Advisory debian.org Vendor Advisory novell.com Vendor Advisory sgi.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/21220	third party advisory
http://www.gentoo.org/security/en/glsa/glsa-200606-27.xml	vendor advisory
http://secunia.com/advisories/20895	third party advisory
http://secunia.com/advisories/21039	third party advisory
http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git%3Ba=commit%3Bh=dc0272b749f0e2b102973b7ac43dbd3908507540
http://www.redhat.com/support/errata/RHSA-2006-0577.html	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10826	vdb entry signature
http://secunia.com/advisories/20887	third party advisory
http://www.vupen.com/english/advisories/2006/2522	vdb entry
http://secunia.com/advisories/20810	third party advisory vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:115	vendor advisory
https://usn.ubuntu.com/307-1/	vendor advisory
http://www.trustix.org/errata/2006/0038	vendor advisory
http://dev.mutt.org/cgi-bin/viewcvs.cgi/mutt/imap/browse.c?r1=1.34.2.2&r2=1.34.2.3
http://secunia.com/advisories/20854	third party advisory
http://secunia.com/advisories/21135	third party advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472221	vendor advisory
http://www.securityfocus.com/bid/18642	vdb entry
http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.013-mutt.html	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27428	vdb entry
http://www.debian.org/security/2006/dsa-1108	vendor advisory
http://www.novell.com/linux/security/advisories/2006_16_sr.html	vendor advisory
http://secunia.com/advisories/20836	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U	vendor advisory
http://securitytracker.com/id?1016482	vdb entry
http://secunia.com/advisories/20960	third party advisory
http://www.securityfocus.com/archive/1/438712/100/0/threaded	mailing list
https://issues.rpath.com/browse/RPL-471
http://secunia.com/advisories/21124	third party advisory
http://secunia.com/advisories/20879	third party advisory

Frequently Asked Questions

What is the severity of CVE-2006-3242?: CVE-2006-3242 has been scored as a high severity vulnerability.
How to fix CVE-2006-3242?: To fix CVE-2006-3242, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-3242 being actively exploited in the wild?: It is possible that CVE-2006-3242 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~6% probability that this vulnerability will be exploited by malicious actors in the next 30 days.