Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mutt for openSUSE:Factory checked in at 2026-10-28 17:50:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mutt (Old) and /work/SRC/openSUSE:Factory/.mutt.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mutt" Wed Oct 28 17:50:13 2026 rev:128 rq:1393414 version:2.4.3 Changes: -------- --- /work/SRC/openSUSE:Factory/mutt/mutt.changes 2026-10-09 21:47:06.073655140 +0200 +++ /work/SRC/openSUSE:Factory/.mutt.new.2252680/mutt.changes 2026-10-28 17:50:16.148417079 +0100 @@ -1,0 +2,32 @@ +Wed Oct 28 13:25:33 UTC 2026 - Dr. Werner Fink <[email protected]> + +- Update to mutt 2.4.3 (Bug fix release) + * Fix OOB heap write in convert_file_from_to(). + This issue was reported by Calif.io, in collaboration with Anthropic, + with a full reproduce and suggested patch. I've reviewed the patch + and concur it is the best approach. + This is due to a logic error in convert_file_from_to() in sendlib.c. + It first counts the number of charsets to try in one loop, and then + allocates and copies the charsets over in a separate loop afterwards. + Unfortunately the second loop's logic does not follow the first loop + exactly, and the counter gets out of sync with a zero-length charset. + For example ":utf-8" where ":" is the delimiter. + The fix is to keep the counter logic the same: incrementing after the + initial zero-length charset check instead of in the for loop increment + clause. + It takes user interaction to trigger this OOB write: using the + received message as a template in a new message via <resend-message>. + The write is of arbitrary length. + Calif.io did not report any exploitation beyond the OOB write. + Nonetheless, I recommend all shipping distributions apply this patch. + * Fix mutt_signed_handler() goodsig setting. + The signed handler did not properly handle the case where + crypt_write_signed() fails, or the case where an unknown signature + type is encountered. In both those cases, goodsig would be left as 1, + giving a status flag in the index as 'S', indicating a goodsig. + Thanks to Acts1631 for the ticket, with a detailed description of the + problem and suggested fix, which this patch is based on. +- Remove patch bsc1284739-CVE-2026-107570.patch + as the above mentioned fix for convert_file_from_to() is fixed now + +------------------------------------------------------------------- Old: ---- bsc1284739-CVE-2026-107570.patch mutt-2.4.2.tar.gz mutt-2.4.2.tar.gz.asc New: ---- mutt-2.4.3.tar.gz mutt-2.4.3.tar.gz.asc ----------(Old B)---------- Old: problem and suggested fix, which this patch is based on. - Remove patch bsc1284739-CVE-2026-107570.patch as the above mentioned fix for convert_file_from_to() is fixed now ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mutt.spec ++++++ --- /var/tmp/diff_new_pack.DCNb4A/_old 2026-10-28 17:50:18.245504849 +0100 +++ /var/tmp/diff_new_pack.DCNb4A/_new 2026-10-28 17:50:18.251505101 +0100 @@ -20,7 +20,7 @@ %bcond_with mutt_openssl %bcond_without mutt_gnutls Name: mutt -Version: 2.4.2 +Version: 2.4.3 Release: 0 Summary: Mail Program # ftp://ftp.mutt.org/mutt/devel/ @@ -55,8 +55,6 @@ Patch18: mutt-1.5.21-mailcap.diff # PATCH-FIX-SUSE: bsc#907453 - CVE-2014-9116: mutt: heap-based buffer overflow in mutt_substrdup() Patch19: bsc907453-CVE-2014-9116-jessie.patch -# PATCH-FIX-UPSTREAM: bsc#128473 - CVE-2026-107570: mutt: heap out-of-bounds write in `convert_file_from_to()` via a crafted `Content-Type` header -Patch20: bsc1284739-CVE-2026-107570.patch # PATCH-ENHANCE-SUSE: boo#1156477 - Mutt has an option to ask before quitting on ^C but quits immediately on ^4 Patch21: mutt-Fix-SIGQUIT-handling.patch BuildRequires: autoconf @@ -164,7 +162,6 @@ %patch -P 16 -b .crlf %patch -P 18 -b .mailcap %patch -P 19 -b .cve2014.9116 -%patch -P 20 -p1 -b .cve2026.107570 %patch -P 21 -b .quit cp %{SOURCE2} . ++++++ mutt-2.4.2.tar.gz -> mutt-2.4.3.tar.gz ++++++ ++++ 3255 lines of diff (skipped)
