Debian Patches

Status for mutt/2.4.1-1.1

Patch Description Author Forwarded Bugs Origin Last update
debian-specific/Muttrc.patch Muttrc
* 2009-01-15 myon: refreshed for mutt-1.5.19; drop our list of ignored headers
in favor of upstream's new unignore list		 Cristoph Berg <myon@debian.org> no 2014-02-27
debian-specific/882690-use_fqdn_from_etc_mailname.patch If /etc/mailname is present, the hostname inside the file will be
used, rather than calling gethostbyname() on the actual hostname.

This patch is based on Md.etc_mailname_gethostbyname.patch which did not apply
cleanly to mutt 1.9.1 so I decided to rewrite to use the mutt libraries.		 no
debian-specific/use_usr_bin_editor.patch use_usr_bin_editor
Even if EDITOR is not set, mutt will always use /usr/bin/editor
(which is set by update-alternatives), rather than falling back
to vi.		 Antonio Radici <antonio@debian.org> no 2014-02-27
debian-specific/correct_docdir_in_man_page.patch correct_docdir_in_man_page
Fix the link so it points to the correct docdir
and gzipped manual.		 Antonio Radici <antonio@debian.org> no 2014-02-27
debian-specific/document_debian_defaults.patch document_debian_defaults
Some customization of the option which are straying
from the default only on Debian systems.		 Antonio Radici <antonio@debian.org> no 2014-02-27
debian-specific/467432-write_bcc.patch 467432-write_bcc
The purpose of this patch is to alter the behavior of the write_bcc option
because exim4, the default SMTP in Debian, does not strip the Bcc headers; by
default write_bcc is set so this could cause a privacy leak.

The behavior that this patch introduces is: never write the Bcc header when the
message is sent, otherwise, if the message is sent to Fcc, then this optin
will be evaluated and the Bcc header will be written based on that.

Background discussion on this is in the following bugs:
http://bugs.debian.org/304718
http://bugs.debian.org/467432

This patch is a slightly modified version of the patch provided by
Stefan Völkel <stefan@bc-bd.org> in the second bug.		 Antonio Radici <antonio@debian.org> no 2014-02-27
debian-specific/566076-build_doc_adjustments.patch 566076-build_doc_adjustments
Use w3m to build the txt manual.		 Antonio Radici <antonio@debian.org> no 2014-02-27
debian-specific/828751-pinentry-gpg2-support.patch This patch enables gpgme by default on the Debian version of mutt starting from
1.7.0-2. More explanations are in NEWS.Debian.		 no
misc/gpg.rc-paths.patch gpg.rc-paths
Use the correct path of pgpewrap.		 Antonio Radici <antonio@debian.org> no 2014-02-27
misc/smime.rc.patch smime.rc
Add CA's provided by ca-certificates to the ones
distributed by the default installation of Mutt.		 Antonio Radici <antonio@debian.org> no 2015-09-15
upstream/528233-readonly-open.patch 528233-readonly-open
Open attachments as read-only so the editor won't be able to modify it;
otherwise the user can believe that he/she can edit it and risk to lose
his/her work (see upstream bug http://bugs.mutt.org/3261)

Debian bugs: #528233, updated in #572203		 Antonio Radici <antonio@debian.org> no 2014-02-27
upstream/1125291-fix-smime_pk7out_command-for-key-extraction.patch Fix smime_pk7out_command for OpenSSL in Debian 13 (Trixie) In Debian 13, `openssl smime` enforces that the operation options are
mutually exclusive, making the combination of `-verify` and `-pk7out` fail
with "smime: Cannot use -pk7out together with -verify".
.
Dropping the `-verify` flag allows the command to execute successfully and
match the behavior seen on previous Debian releases.		 Andreas <bugs.debian.org> no debian vendor, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125291 2026-06-21
upstream/787968-muttrc-man-grammar-fix.patch Fix grammar in muttrc man page for auto_view / unauto_view The man page describes both `auto_view` and `unauto_view` together but
mistakenly refers to them in the singular ("This commands permits...").
Correct this to the plural "These commands permit..." to ensure proper
grammar and consistency with other paired commands in the document.		 積丹尼 Dan Jacobson <jidanni@jidanni.org> yes debian upstream upstream, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=788000 2026-06-21
upstream/shellcheck-errors.patch Remove obsolete x-prefix from string comparisons Modern POSIX shells handle empty variables safely when quoted. This fixes
several SC2268 style warnings reported by shellcheck during the build
process by converting the legacy x-prefix checks to use standard -z and
-n operators.		 Antonino Radici <antonio@debian.org> no 2026-06-21
upstream/Fix-OOB-heap-write-in-convert_file_from_to.patch Fix OOB heap write in convert_file_from_to().
This issue was reported by Calif.io, in collaboration with Anthropic,
with a full reproduce and suggested patch. I've reviewed the patch
and concur it is the best approach.

This is due to a logic error in convert_file_from_to() in sendlib.c.
It first counts the number of charsets to try in one loop, and then
allocates and copies the charsets over in a separate loop afterwards.

Unfortunately the second loop's logic does not follow the first loop
exactly, and the counter gets out of sync with a zero-length charset.
For example ":utf-8" where ":" is the delimiter.

The fix is to keep the counter logic the same: incrementing after the
initial zero-length charset check instead of in the for loop increment
clause.

It takes user interaction to trigger this OOB write: using the
received message as a template in a new message via <resend-message>.
The write is of arbitrary length.

Calif.io did not report any exploitation beyond the OOB write.
Nonetheless, I recommend all shipping distributions apply this patch.		 "Kevin J. McCarthy" <kevin@8t8.us> no debian https://gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54 2026-10-06

All known versions for source package 'mutt'

Links