CVE-2018-14362 Path traversal in n/a
Attackers can manipulate message-cache pathnames via unsafe characters in pop.c, potentially reading or modifying files outside intended directories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14362?
CVE-2018-14362 is a critical path traversal vulnerability in Canonical Ubuntu Linux, published on 17 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.
Weakness: CWE-119
Which versions are affected by CVE-2018-14362?
It affects 10 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Mutt Mutt, Neomutt Neomutt, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 4 more.
How do I fix CVE-2018-14362?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-14362 being exploited?
There is no known exploitation of CVE-2018-14362 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-14362, DEBIAN-CVE-2018-14362, GHSA-8wxh-p6hf-c3ph, UBUNTU-CVE-2018-14362.