Search for packages
Package details: pkg:deb/debian/neomutt@20180716%2Bdfsg.1-1%2Bdeb10u2
purl pkg:deb/debian/neomutt@20180716%2Bdfsg.1-1%2Bdeb10u2
Next non-vulnerable version 20250510+dfsg-2~bpo12+1
Latest non-vulnerable version 20250510+dfsg-2~bpo12+1
Risk 4.1
Vulnerabilities affecting this package (5)
Vulnerability Summary Fixed by
VCID-ccn3-psjf-a3dx
Aliases:
CVE-2020-14954
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
20201127+dfsg.1-1.2
Affected by 3 other vulnerabilities.
VCID-fr8u-p6p3-hkbj
Aliases:
CVE-2020-14154
Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.
20201127+dfsg.1-1.2
Affected by 3 other vulnerabilities.
VCID-hqax-xuvj-rybn
Aliases:
CVE-2020-14093
Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
20201127+dfsg.1-1.2
Affected by 3 other vulnerabilities.
VCID-y5mf-2t3a-kqf9
Aliases:
CVE-2020-28896
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
20201127+dfsg.1-1.2
Affected by 3 other vulnerabilities.
VCID-z4yv-4u29-6qfm
Aliases:
CVE-2021-32055
Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
20201127+dfsg.1-1.2
Affected by 3 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-08-01T18:47:30.167510+00:00 Debian Oval Importer Affected by VCID-y5mf-2t3a-kqf9 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T18:09:42.121512+00:00 Debian Oval Importer Affected by VCID-ccn3-psjf-a3dx https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T17:00:55.316477+00:00 Debian Oval Importer Affected by VCID-hqax-xuvj-rybn https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T14:07:19.905531+00:00 Debian Oval Importer Affected by VCID-z4yv-4u29-6qfm https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T12:50:00.676840+00:00 Debian Oval Importer Affected by VCID-fr8u-p6p3-hkbj https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0