[linux-security] remote exploit in mutt

[Martin Siegert <siegert@sfu.ca>]

Topic
=====
An overflow in mutt's address parsing code can be exploited by a
specifically crafted email message.

Problem Description
===================
An overflow exists in mutt's RFC822 address parser. A remote attacker
could send a carefully crafted email message which when read by mutt would
be able to overwrite arbitrary bytes in memory. This can lead to
arbitrary code being executed under the permissions of the user who is
reading the email. Upgrading to a fixed version is strongly advised.

Affected Systems
================
mutt versions < 1.2.5.1 (this includes mutt-1.2.5i)
 
Workaround
==========
Use elm instead. 
Note: using pine cannot be recommended. Currently there is a discussion
going on on the relevant security mailing lists about bugs in pine for
which no fixes seem to be available (yet).

Solution
========
upgrade to mutt, version 1.2.5.1 or 1.3.25

RedHat 6.x
----------
rpm -Fvh mutt-1.2.5.1-0.6.i386.rpm

RedHat 7.0, 7.1
---------------
rpm -Fvh mutt-1.2.5.1-0.7.i386.rpm

RedHat 7.2
----------
mutt-1.2.5.1-1.i386.rpm

Debian 2.2 (potato)
-------------------
upgrade to mutt_1.2.5-5_i386.deb