Vulnerabilites related to notmuchmail - notmuch
Vulnerability from fkie_nvd
Published
2012-09-25 23:55
Modified
2024-11-21 01:36
Severity ?
Summary
emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| notmuchmail | notmuch | * | |
| notmuchmail | notmuch | 0.1 | |
| notmuchmail | notmuch | 0.1.1 | |
| notmuchmail | notmuch | 0.2 | |
| notmuchmail | notmuch | 0.3 | |
| notmuchmail | notmuch | 0.3.1 | |
| notmuchmail | notmuch | 0.4 | |
| notmuchmail | notmuch | 0.5 | |
| notmuchmail | notmuch | 0.6 | |
| notmuchmail | notmuch | 0.6 | |
| notmuchmail | notmuch | 0.6 | |
| notmuchmail | notmuch | 0.6.1 | |
| notmuchmail | notmuch | 0.7 | |
| notmuchmail | notmuch | 0.7 | |
| notmuchmail | notmuch | 0.8 | |
| notmuchmail | notmuch | 0.8 | |
| notmuchmail | notmuch | 0.8 | |
| notmuchmail | notmuch | 0.9 | |
| notmuchmail | notmuch | 0.9 | |
| notmuchmail | notmuch | 0.9 | |
| notmuchmail | notmuch | 0.10 | |
| notmuchmail | notmuch | 0.10 | |
| notmuchmail | notmuch | 0.10 | |
| notmuchmail | notmuch | 0.10.1 | |
| notmuchmail | notmuch | 0.10.2 | |
| notmuchmail | notmuch | 0.11 | |
| notmuchmail | notmuch | 0.11 | |
| notmuchmail | notmuch | 0.11 | |
| notmuchmail | notmuch | 0.11 | |
| notmuchmail | notmuch | 0.11 | |
| gnu | emacs | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB1500D-9150-4BBF-91BD-A68733C64C20",
"versionEndIncluding": "0.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "14A0CF88-A2C2-4B35-9965-2618570B702A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C2229CDF-387B-43E6-85C6-7275224C596B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B91CE3D6-6A05-42E1-82A9-9808967B8E3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F2FA9EAB-0A4A-43E0-A927-F7D2700C3314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7D0474D6-0E0E-4647-B0A7-782C8C4294C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E13D7E98-A8CE-4403-A719-D9D0DB802CA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9A72A463-C251-4B84-8339-0F70B5643B12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB96230-DC49-4AAC-A90F-5EFA030DC9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.6:254:*:*:*:*:*:*",
"matchCriteriaId": "DDD064CA-5162-4C8A-B40B-EE4A802B71B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D3745A16-9CCB-4036-A235-9E99ADAF7508",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F9EF2B1-879C-4E65-A5C8-412A5CD1D4A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14967A70-17B6-4488-B0C4-7C63F0BAD345",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A3996C02-D377-45E7-908F-F08DAD0C8ADF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "26BF6FB2-DAEF-459A-8F15-6B6B9543AF90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.8:rc0:*:*:*:*:*:*",
"matchCriteriaId": "C3C2CB33-0E7B-4152-AFA2-1665694FC249",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EC445E89-A292-4D1D-BF62-145567D304B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "359AFDBB-811E-47DC-95A5-A5282880CEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F132E0D2-9859-4D29-A134-9DBE3279CF61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "BEA36D17-1F14-4717-A2D4-0CA5BFC0615A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5B95DD4E-B5EC-4E96-8043-47C254C8EF2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "ED2DD848-DD3C-47EB-84EA-34788DCE0A16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.10:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CAC9C2ED-C862-47B7-BC38-7DEC8E5862A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "435B1163-6B1D-44B7-9E4E-26F56D536EF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "752A40E9-3EF3-49E3-BDD8-1788B4F3D307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7A2BAF5C-9BB8-4913-A1B8-695180701CE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "26790804-3EA7-4B5D-A6C0-26B36DB90455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.11:rc2-1:*:*:*:*:*:*",
"matchCriteriaId": "A24E7B09-78ED-4711-843A-89C448AC176A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.11:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5C115700-5633-4075-B639-278208446289",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:notmuchmail:notmuch:0.11:rc3-1:*:*:*:*:*:*",
"matchCriteriaId": "1466EABE-D6CD-4874-88BD-69B1FBF7111C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gnu:emacs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "25C568C8-14C8-4243-98DB-7914F4B63F99",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message."
},
{
"lang": "es",
"value": "emacs/notmuch-mua.el en notmuch antes de v0.11.1, cuando se utiliza el interface Emacs, permite leer archivos de su elecci\u00f3n a atacantes remotos con cierta ayuda de usuarios locales a trav\u00e9s de etiquetas MML modificadas, que no est\u00e1n debidamente marcadas en una respuesta de correo electr\u00f3nico podr\u00eda ocasionar que cualquier tipo de fichero pudiera ser adjuntarse al mensaje.\r\n"
}
],
"id": "CVE-2012-1103",
"lastModified": "2024-11-21T01:36:25.640",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-09-25T23:55:01.923",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://notmuchmail.org/news/release-0.11.1/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48139"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2012/dsa-2416"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/04/5"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/05/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/52155"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://notmuchmail.org/news/release-0.11.1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2416"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/04/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/05/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52155"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2012-1103
Vulnerability from cvelistv5
Published
2012-09-25 23:00
Modified
2024-09-16 22:56
Severity ?
EPSS score ?
Summary
emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://notmuchmail.org/news/release-0.11.1/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/52155 | vdb-entry, x_refsource_BID | |
| http://www.openwall.com/lists/oss-security/2012/03/05/6 | mailing-list, x_refsource_MLIST | |
| http://www.debian.org/security/2012/dsa-2416 | vendor-advisory, x_refsource_DEBIAN | |
| http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/03/04/5 | mailing-list, x_refsource_MLIST | |
| http://secunia.com/advisories/48139 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:27.436Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://notmuchmail.org/news/release-0.11.1/"
},
{
"name": "52155",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52155"
},
{
"name": "[oss-security] 20120304 Re: CVE request: notmuch",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/05/6"
},
{
"name": "DSA-2416",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2416"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el"
},
{
"name": "[oss-security] 20120304 CVE request: notmuch",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/04/5"
},
{
"name": "48139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48139"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-09-25T23:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://notmuchmail.org/news/release-0.11.1/"
},
{
"name": "52155",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52155"
},
{
"name": "[oss-security] 20120304 Re: CVE request: notmuch",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/05/6"
},
{
"name": "DSA-2416",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2416"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el"
},
{
"name": "[oss-security] 20120304 CVE request: notmuch",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/04/5"
},
{
"name": "48139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48139"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-1103",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://notmuchmail.org/news/release-0.11.1/",
"refsource": "CONFIRM",
"url": "http://notmuchmail.org/news/release-0.11.1/"
},
{
"name": "52155",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52155"
},
{
"name": "[oss-security] 20120304 Re: CVE request: notmuch",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/03/05/6"
},
{
"name": "DSA-2416",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2416"
},
{
"name": "http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el",
"refsource": "CONFIRM",
"url": "http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el"
},
{
"name": "[oss-security] 20120304 CVE request: notmuch",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/03/04/5"
},
{
"name": "48139",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48139"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-1103",
"datePublished": "2012-09-25T23:00:00Z",
"dateReserved": "2012-02-14T00:00:00Z",
"dateUpdated": "2024-09-16T22:56:49.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}