Package: mutt
Version: 2.2.12-0.1~deb12u1
Severity: grave
Tags: security upstream
Forwarded: https://gitlab.com/muttmua/mutt/-/issues/495
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <t...@security.debian.org>
I've reported the following bug upstream:
Consider a mailbox with a message as follows:
From x@y.invalid Thu Jan 16 09:54:16 2025
From: Name (comment) <x@y.invalid>
Subject: msg
Mutt 2.2.13 displays
From: Name <x@y.invalid>
instead of
From: Name (comment) <x@y.invalid>
This has the effect to hide important information when it is put under
the form of a RFC822/2822/5322 comment, such as added after address
rewriting to solve DMARC's failures[*], which is done by the Sympa
mailing-list management software. The comment is also dropped when
replying to the "From:" address (and obviously, if this is copy-pasted).
[*] https://dmarcreport.com/blog/solving-dmarcs-failures-with-mailing-lists/
So, as a user, one may not notice that the address has actually been
rewritten, and as a consequence, one may send a private message to the
whole mailing-list. Experience showed that when the comment had not
been added yet here at ENS-Lyon, many users sent private messages to
the lists. A comment under the form "original-address via list-name
Mailing List" is now added, but Mutt does not show it, contrary to
other MUAs.
-- Package-specific info:
Mutt 2.2.13+79 (f87ab401) vl-169878 (2024-11-04)
Copyright (C) 1996-2023 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.
System: Linux 6.1.0-30-amd64 (x86_64)
ncurses: ncurses 6.4.20221231 (compiled with 6.4)
Compiler:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/12/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 12.2.0-14'
--with-bugurl=file:///usr/share/doc/gcc-12/README.Bugs
--enable-languages=c,ada,c++,go,d,fortran,objc,obj-c++,m2 --prefix=/usr
--with-gcc-major-version-only --program-suffix=-12
--program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new
--enable-gnu-unique-object --disable-vtable-verify --enable-plugin
--enable-default-pie --with-system-zlib --enable-libphobos-checking=release
--with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch
--disable-werror --enable-cet --with-arch-32=i686 --with-abi=m64
--with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic
--enable-offload-targets=nvptx-none=/build/gcc-12-bTRWOB/gcc-12-12.2.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-12-bTRWOB/gcc-12-12.2.0/debian/tmp-gcn/usr
--enable-offload-defaulted --without-cuda-driver --enable-checking=release
--build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.2.0 (Debian 12.2.0-14)
Configure options: --prefix=/srv/d_joooj/home/vinc17
--exec-prefix=/srv/d_joooj/home/vinc17/. --enable-debug --enable-pop
--enable-imap --with-ssl --enable-compressed
--with-exec-shell=/srv/d_joooj/home/vinc17/bin/sh.screen --enable-gpgme
--with-system-dotlock=/usr/bin/mutt_dotlock CC=gcc 'CFLAGS=-g -O3 -march=native
-fsanitize=undefined -fno-sanitize-recover'
Compilation CFLAGS: -Wall -pedantic -Wno-long-long -g -O3 -march=native
-fsanitize=undefined -fno-sanitize-recover
Compile options:
-DOMAIN
+DEBUG
-HOMESPOOL +USE_SETGID +USE_DOTLOCK +DL_STANDALONE +USE_FCNTL -USE_FLOCK
+USE_POP +USE_IMAP -USE_SMTP
+USE_SSL_OPENSSL -USE_SSL_GNUTLS -USE_SASL -USE_GSASL -USE_GSS
+HAVE_GETADDRINFO
+HAVE_REGCOMP -USE_GNU_REGEX
+HAVE_COLOR +HAVE_START_COLOR +HAVE_TYPEAHEAD +HAVE_BKGDSET
+HAVE_CURS_SET +HAVE_META +HAVE_RESIZETERM +HAVE_FUTIMENS
+CRYPT_BACKEND_CLASSIC_PGP +CRYPT_BACKEND_CLASSIC_SMIME +CRYPT_BACKEND_GPGME
-EXACT_ADDRESS -SUN_ATTACHMENT
+ENABLE_NLS -LOCALES_HACK +HAVE_WC_FUNCS +HAVE_LANGINFO_CODESET
+HAVE_LANGINFO_YESEXPR
+HAVE_ICONV -ICONV_NONTRANS -HAVE_LIBIDN -HAVE_LIBIDN2 +HAVE_GETSID
-USE_HCACHE
-USE_SIDEBAR +USE_COMPRESSED +USE_INOTIFY
ISPELL="/bin/ispell"
SENDMAIL="/sbin/sendmail"
MAILPATH="/var/mail"
PKGDATADIR="/srv/d_joooj/home/vinc17/share/mutt"
SYSCONFDIR="/srv/d_joooj/home/vinc17/etc"
EXECSHELL="/srv/d_joooj/home/vinc17/bin/sh.screen"
-MIXMASTER
To contact the developers, please mail to <mutt-...@mutt.org>.
To report a bug, please contact the Mutt maintainers via gitlab:
https://gitlab.com/muttmua/mutt/issues
patch-20240710.vl.pretty_size.2
patch-20220609.vl.simplesearchkw.1
patch-20220609.pdmef.progress.vl.1
patch-20220609.vl.address_all_patt.1
patch-20220609.tamovl.sysdotlock.1
-- System Information:
Debian Release: 12.9
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable-debug'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-30-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages mutt depends on:
ii libc6 2.36-9+deb12u9
ii libgnutls30 3.7.9-2+deb12u3
ii libgpg-error0 1.46-1
ii libgpgme11 1.18.0-3+b1
ii libgsasl18 2.2.0-1
ii libgssapi-krb5-2 1.20.1-2+deb12u2
ii libidn2-0 2.3.3-1+b1
ii libncursesw6 6.4-4
ii libtinfo6 6.4-4
ii libtokyocabinet9 1.4.48-15
ii zlib1g 1:1.2.13.dfsg-1
Versions of packages mutt recommends:
ii locales 2.36-9+deb12u9
ii mailcap 3.70+nmu1
ii sensible-utils 0.0.17+nmu1
Versions of packages mutt suggests:
ii aspell 0.60.8-4+b1
ii ca-certificates 20230311
ii gnupg 2.2.40-1.1
ii ispell 3.4.05-1
ii openssl 3.0.15-1~deb12u1
ii postfix [mail-transport-agent] 3.7.11-0+deb12u1
ii urlview 0.9-23.1
Versions of packages mutt is related to:
ii mutt 2.2.12-0.1~deb12u1
-- no debconf information
--
Vincent Lefèvre <vinc...@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
