CVE catalog

CVE-2009-3765

mutt: CVE-2009-3765

[CVE catalog]

Severity
Low
Source
[NVD] · [CVE record]
EPSS
1.05% · Oct 25, 2026

mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmuttsid2.4.1-1.1not affected
Debianmuttforky2.4.1-1not affected
Debianmutttrixie2.2.13-1+deb13u1not affected
Debianmutttrixie-security2.2.13-1+deb13u2not affected
Debianmuttbookworm2.2.12-0.1~deb12u1not affected
Debianmuttbookworm-security2.2.9-1+deb12u1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianmuttsourcesidNot affectedunimportantNot reportedNot reported
DebianmuttsourceforkyNot affectedunimportantNot reportedNot reported
DebianmuttsourcetrixieNot affectedunimportantNot reportedNot reported
DebianmuttsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [mutt]Unknown
    Details (4)

    • 2.2.12-0.1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · mutt · debian · bookworm

    • 2.2.12-0.1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · mutt · debian · bookworm

    • 2.2.9-1+deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · mutt · debian · bookworm

    • 2.2.9-1+deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · mutt · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS]