CVE-2012-1103

MEDIUM 4.3CVE-2012-1103 · Published 25/09/2012 · updated 16/06/2026

In short

CVE-2012-1103 is a MEDIUM (CVSS 4.3) vulnerability affecting notmuch (notmuchmail).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
notmuch notmuchmail	`= 0.1= 0.1.1= 0.10= 0.10.1= 0.10.2= 0.11= 0.2= 0.3= 0.3.1= 0.4= 0.5= 0.6= 0.6.1= 0.7= 0.8= 0.9≤ 0.11`	No fix yet

Description

emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.

References

git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el · Exploit
notmuchmail.org/news/release-0.11.1 · Vendor Advisory
secunia.com/advisories/48139 · Vendor Advisory
debian.org/security/2012/dsa-2416
openwall.com/lists/oss-security/2012/03/04/5 · Exploit
openwall.com/lists/oss-security/2012/03/05/6 · Exploit
securityfocus.com/bid/52155

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free