Vulnerability in Mutt
CVE-2007-2683
Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 3.5 (Low). Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.008 (54.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: -0.000
Affected products
- Mutt — versions 1.4.2
Public proof-of-concept exploits
References
- secunia.com/advisories/25529 (third-party-advisory)
- www.securitytracker.com/id (vdb-entry)
- www.trustix.org/errata/2007/0024/ (vendor-advisory)
- secunia.com/advisories/26415 (third-party-advisory)
- dev.mutt.org/trac/ticket/2885
- secunia.com/advisories/25408 (third-party-advisory)
- osvdb.org/34973 (vdb-entry)
- bugzilla.redhat.com/bugzilla/show_bug.cgi
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10543 (signature, vdb-entry)
- secunia.com/advisories/25546 (third-party-advisory)
Frequently asked questions
- What is CVE-2007-2683?
- CVE-2007-2683 is a vulnerability in Mutt. Published 2007-05-15.
- Is CVE-2007-2683 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.