Backport security patches from mutt-1.10.1

Resolves: #1602082 (CVE-2018-14354, CVE-2018-14355, CVE-2018-14362)
Resolves: #1602916 (CVE-2018-14357)
Resolves: #1602923 (CVE-2018-14350)
Resolves: #1602935 (CVE-2018-14349)
Resolves: #1602954 (CVE-2018-14351)
Resolves: CVE-2018-14358, CVE-2018-14352, CVE-2018-14353, CVE-2018-14356,
  CVE-2018-14359

mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch

@@ -0,0 +1,100 @@
+From 3d9028fec8f4d08db2251096307c0bbbebce669a Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 14:25:28 -0700
+Subject: [PATCH] Check outbuf length in mutt_from_base64()
+
+The obuf can be overflowed in auth_cram.c, and possibly auth_gss.c.
+
+Thanks to Jeriko One for the bug report.
+---
+ base64.c         | 8 +++++++-
+ imap/auth_cram.c | 2 +-
+ imap/auth_gss.c  | 4 ++--
+ protos.h         | 2 +-
+ 4 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/base64.c b/base64.c
+index fd3ffb88..120d4baa 100644
+--- a/base64.c
++++ b/base64.c
+@@ -81,7 +81,7 @@ void mutt_to_base64 (unsigned char *out, const unsigned char *in, size_t len,
+ 
+ /* Convert '\0'-terminated base 64 string to raw bytes.
+  * Returns length of returned buffer, or -1 on error */
+-int mutt_from_base64 (char *out, const char *in)
++int mutt_from_base64 (char *out, const char *in, size_t olen)
+ {
+   int len = 0;
+   register unsigned char digit1, digit2, digit3, digit4;
+@@ -103,14 +103,20 @@ int mutt_from_base64 (char *out, const char *in)
+     in += 4;
+ 
+     /* digits are already sanity-checked */
++    if (len == olen)
++      return len;
+     *out++ = (base64val(digit1) << 2) | (base64val(digit2) >> 4);
+     len++;
+     if (digit3 != '=')
+     {
++      if (len == olen)
++        return len;
+       *out++ = ((base64val(digit2) << 4) & 0xf0) | (base64val(digit3) >> 2);
+       len++;
+       if (digit4 != '=')
+       {
++        if (len == olen)
++          return len;
+ 	*out++ = ((base64val(digit3) << 6) & 0xc0) | base64val(digit4);
+ 	len++;
+       }
+diff --git a/imap/auth_cram.c b/imap/auth_cram.c
+index 9b6db9af..87617215 100644
+--- a/imap/auth_cram.c
++++ b/imap/auth_cram.c
+@@ -71,7 +71,7 @@ imap_auth_res_t imap_auth_cram_md5 (IMAP_DATA* idata, const char* method)
+     goto bail;
+   }
+ 
+-  if ((len = mutt_from_base64 (obuf, idata->buf + 2)) == -1)
++  if ((len = mutt_from_base64 (obuf, idata->buf + 2, sizeof(obuf) - 1)) == -1)
+   {
+     dprint (1, (debugfile, "Error decoding base64 response.\n"));
+     goto bail;
+diff --git a/imap/auth_gss.c b/imap/auth_gss.c
+index a08e7c20..e14f4aac 100644
+--- a/imap/auth_gss.c
++++ b/imap/auth_gss.c
+@@ -197,7 +197,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA* idata, const char* method)
+       goto bail;
+     }
+ 
+-    request_buf.length = mutt_from_base64 (buf2, idata->buf + 2);
++    request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2));
+     request_buf.value = buf2;
+     sec_token = &request_buf;
+ 
+@@ -233,7 +233,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA* idata, const char* method)
+     dprint (1, (debugfile, "Error receiving server response.\n"));
+     goto bail;
+   }
+-  request_buf.length = mutt_from_base64 (buf2, idata->buf + 2);
++  request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2));
+   request_buf.value = buf2;
+ 
+   maj_stat = gss_unwrap (&min_stat, context, &request_buf, &send_token,
+diff --git a/protos.h b/protos.h
+index 8bcda67f..f933e925 100644
+--- a/protos.h
++++ b/protos.h
+@@ -397,7 +397,7 @@ ADDRESS *alias_reverse_lookup (ADDRESS *);
+ 
+ /* base64.c */
+ void mutt_to_base64 (unsigned char*, const unsigned char*, size_t, size_t);
+-int mutt_from_base64 (char*, const char*);
++int mutt_from_base64 (char*, const char*, size_t);
+ 
+ /* utf8.c */
+ int mutt_wctoutf8 (char *s, unsigned int c, size_t buflen);
+-- 
+2.13.6
+

mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch

@@ -0,0 +1,56 @@
+From 3287534daa3beac68e2e83ca4b4fe8a3148ff870 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 12:15:00 -0700
+Subject: [PATCH] Don't overflow tmp in msg_parse_fetch.
+
+Ensure INTERNALDATE and RFC822.SIZE field sizes fit temp buffer.
+
+Thanks to Jeriko One for the bug report and patch, which this patch is
+based upon.
+---
+ imap/message.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/imap/message.c b/imap/message.c
+index 9ebfeb8e..e6056555 100644
+--- a/imap/message.c
++++ b/imap/message.c
+@@ -1345,6 +1345,7 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
+ {
+   char tmp[SHORT_STRING];
+   char *ptmp;
++  size_t dlen;
+ 
+   if (!s)
+     return -1;
+@@ -1378,8 +1379,12 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
+       }
+       s++;
+       ptmp = tmp;
+-      while (*s && *s != '\"')
++      dlen = sizeof(tmp) - 1;
++      while (*s && *s != '\"' && dlen)
++      {
+         *ptmp++ = *s++;
++        dlen--;
++      }
+       if (*s != '\"')
+         return -1;
+       s++; /* skip past the trailing " */
+@@ -1391,8 +1396,12 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
+       s += 11;
+       SKIPWS (s);
+       ptmp = tmp;
+-      while (isdigit ((unsigned char) *s))
++      dlen = sizeof(tmp) - 1;
++      while (isdigit ((unsigned char) *s) && dlen)
++      {
+         *ptmp++ = *s++;
++        dlen--;
++      }
+       *ptmp = 0;
+       h->content_length = atoi (tmp);
+     }
+-- 
+2.13.6
+

mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch

@@ -0,0 +1,27 @@
+From e154cba1b3fc52bb8cb8aa846353c0db79b5d9c6 Mon Sep 17 00:00:00 2001
+From: JerikoOne <jeriko.one@gmx.us>
+Date: Fri, 13 Jul 2018 10:47:11 -0700
+Subject: [PATCH] Ensure UID in fetch_uidl.
+
+---
+ pop.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/pop.c b/pop.c
+index ecfd8d7c..d9d95fbe 100644
+--- a/pop.c
++++ b/pop.c
+@@ -152,6 +152,10 @@ static int fetch_uidl (char *line, void *data)
+       endp++;
+   memmove(line, endp, strlen(endp) + 1);
+ 
++  /* uid must be at least be 1 byte */
++  if (strlen(line) == 0)
++    return -1;
++
+   for (i = 0; i < ctx->msgcount; i++)
+     if (!mutt_strcmp (line, ctx->hdrs[i]->data))
+       break;
+-- 
+2.13.6
+

mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch

@@ -0,0 +1,55 @@
+From e0131852c6059107939893016c8ff56b6e42865d Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Thu, 12 Jul 2018 20:46:37 -0700
+Subject: [PATCH] Fix imap_quote_string() length check errors.
+
+The function wasn't properly checking for dlen<2 before quoting, and
+wasn't properly pre-adjusting dlen to include the initial quote.
+
+Thanks to Jeriko One for reporting these issues.
+---
+ imap/util.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/imap/util.c b/imap/util.c
+index 3274a70c..27792944 100644
+--- a/imap/util.c
++++ b/imap/util.c
+@@ -614,20 +614,29 @@ static void _imap_quote_string (char *dest, size_t dlen, const char *src,
+   char *pt;
+   const char *s;
+ 
++  if (!(dest && dlen && src && to_quote))
++    return;
++
++  if (dlen < 3)
++  {
++    *dest = 0;
++    return;
++  }
++
+   pt = dest;
+   s  = src;
+ 
+-  *pt++ = '"';
+-  /* save room for trailing quote-char */
+-  dlen -= 2;
++  /* save room for pre/post quote-char and trailing null */
++  dlen -= 3;
+ 
++  *pt++ = '"';
+   for (; *s && dlen; s++)
+   {
+     if (strchr (to_quote, *s))
+     {
++      if (dlen < 2)
++        break;
+       dlen -= 2;
+-      if (!dlen)
+-	break;
+       *pt++ = '\\';
+       *pt++ = *s;
+     }
+-- 
+2.13.6
+

mutt-1.9.2-Handle_NO_response_without_message_properly.patch

@@ -0,0 +1,25 @@
+From 9347b5c01dc52682cb6be11539d9b7ebceae4416 Mon Sep 17 00:00:00 2001
+From: JerikoOne <jeriko.one@gmx.us>
+Date: Fri, 13 Jul 2018 12:24:58 -0700
+Subject: [PATCH] Handle NO response without message properly
+
+---
+ imap/command.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/imap/command.c b/imap/command.c
+index 82bf54c4..bb267f62 100644
+--- a/imap/command.c
++++ b/imap/command.c
+@@ -586,7 +586,7 @@ static int cmd_handle_untagged (IMAP_DATA* idata)
+     dprint (2, (debugfile, "Handling untagged NO\n"));
+ 
+     /* Display the warning message from the server */
+-    mutt_error ("%s", s+3);
++    mutt_error ("%s", s+2);
+     mutt_sleep (2);
+   }
+ 
+-- 
+2.13.6
+

mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch

@@ -0,0 +1,34 @@
+From e57a8602b45f58edf7b3ffb61bb17525d75dfcb1 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 12:35:50 -0700
+Subject: [PATCH] Verify IMAP status mailbox literal count size.
+
+Ensure the length isn't bigger than the idata->buf.
+
+Thanks to Jeriko One fo the bug report and patch, which this commit is
+based upon.
+---
+ imap/command.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/imap/command.c b/imap/command.c
+index bb267f62..6abd759d 100644
+--- a/imap/command.c
++++ b/imap/command.c
+@@ -969,6 +969,13 @@ static void cmd_parse_status (IMAP_DATA* idata, char* s)
+       idata->status = IMAP_FATAL;
+       return;
+     }
++
++    if (strlen(idata->buf) < litlen)
++    {
++      dprint (1, (debugfile, "Error parsing STATUS mailbox\n"));
++      return;
++    }
++
+     mailbox = idata->buf;
+     s = mailbox + litlen;
+     *s = '\0';
+-- 
+2.13.6
+

mutt-1.9.2-quote_mbox_names.patch

@@ -0,0 +1,127 @@
+From 185152818541f5cdc059cbff3f3e8b654fc27c1d Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Sat, 7 Jul 2018 19:03:44 -0700
+Subject: [PATCH] Properly quote IMAP mailbox names when (un)subscribing.
+
+When handling automatic subscription (via $imap_check_subscribed), or
+manual subscribe/unsubscribe commands, mutt generating a "mailboxes"
+command but failed to properly escape backquotes.
+
+Thanks to Jeriko One for the detailed bug report and patch, which this
+commit is based upon.
+---
+ imap/command.c      |  5 +++--
+ imap/imap.c         |  7 +++++--
+ imap/imap_private.h |  3 ++-
+ imap/util.c         | 25 ++++++++++++++++++++-----
+ 4 files changed, 30 insertions(+), 10 deletions(-)
+
+diff --git a/imap/command.c b/imap/command.c
+index c8825981..c79d4f28 100644
+--- a/imap/command.c
++++ b/imap/command.c
+@@ -842,8 +842,9 @@ static void cmd_parse_lsub (IMAP_DATA* idata, char* s)
+ 
+   strfcpy (buf, "mailboxes \"", sizeof (buf));
+   mutt_account_tourl (&idata->conn->account, &url);
+-  /* escape \ and " */
+-  imap_quote_string(errstr, sizeof (errstr), list.name);
++  /* escape \ and ". Also escape ` because the resulting
++   * string will be passed to mutt_parse_rc_line. */
++  imap_quote_string_and_backquotes (errstr, sizeof (errstr), list.name);
+   url.path = errstr + 1;
+   url.path[strlen(url.path) - 1] = '\0';
+   if (!mutt_strcmp (url.user, ImapUser))
+diff --git a/imap/imap.c b/imap/imap.c
+index 668203b8..c3a8ffd0 100644
+--- a/imap/imap.c
++++ b/imap/imap.c
+@@ -1930,6 +1930,7 @@ int imap_subscribe (char *path, int subscribe)
+   char buf[LONG_STRING];
+   char mbox[LONG_STRING];
+   char errstr[STRING];
++  int mblen;
+   BUFFER err, token;
+   IMAP_MBOX mx;
+ 
+@@ -1951,8 +1952,10 @@ int imap_subscribe (char *path, int subscribe)
+     mutt_buffer_init (&err);
+     err.data = errstr;
+     err.dsize = sizeof (errstr);
+-    snprintf (mbox, sizeof (mbox), "%smailboxes \"%s\"",
+-              subscribe ? "" : "un", path);
++    mblen = snprintf (mbox, sizeof (mbox), "%smailboxes ",
++                      subscribe ? "" : "un");
++    imap_quote_string_and_backquotes (mbox + mblen, sizeof(mbox) - mblen,
++                                      path);
+     if (mutt_parse_rc_line (mbox, &token, &err))
+       dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", errstr));
+     FREE (&token.data);
+diff --git a/imap/imap_private.h b/imap/imap_private.h
+index 312fbfe4..349c5a49 100644
+--- a/imap/imap_private.h
++++ b/imap/imap_private.h
+@@ -301,7 +301,8 @@ char* imap_next_word (char* s);
+ time_t imap_parse_date (char* s);
+ void imap_make_date (char* buf, time_t timestamp);
+ void imap_qualify_path (char *dest, size_t len, IMAP_MBOX *mx, char* path);
+-void imap_quote_string (char* dest, size_t slen, const char* src);
++void imap_quote_string (char* dest, size_t dlen, const char* src);
++void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src);
+ void imap_unquote_string (char* s);
+ void imap_munge_mbox_name (IMAP_DATA *idata, char *dest, size_t dlen, const char *src);
+ void imap_unmunge_mbox_name (IMAP_DATA *idata, char *s);
+diff --git a/imap/util.c b/imap/util.c
+index 914c93c3..3274a70c 100644
+--- a/imap/util.c
++++ b/imap/util.c
+@@ -608,11 +608,9 @@ void imap_qualify_path (char *dest, size_t len, IMAP_MBOX *mx, char* path)
+ }
+ 
+ 
+-/* imap_quote_string: quote string according to IMAP rules:
+- *   surround string with quotes, escape " and \ with \ */
+-void imap_quote_string (char *dest, size_t dlen, const char *src)
++static void _imap_quote_string (char *dest, size_t dlen, const char *src,
++                                const char *to_quote)
+ {
+-  static const char quote[] = "\"\\";
+   char *pt;
+   const char *s;
+ 
+@@ -625,7 +623,7 @@ void imap_quote_string (char *dest, size_t dlen, const char *src)
+ 
+   for (; *s && dlen; s++)
+   {
+-    if (strchr (quote, *s))
++    if (strchr (to_quote, *s))
+     {
+       dlen -= 2;
+       if (!dlen)
+@@ -643,6 +641,23 @@ void imap_quote_string (char *dest, size_t dlen, const char *src)
+   *pt = 0;
+ }
+ 
++/* imap_quote_string: quote string according to IMAP rules:
++ *   surround string with quotes, escape " and \ with \ */
++void imap_quote_string (char *dest, size_t dlen, const char *src)
++{
++  _imap_quote_string (dest, dlen, src, "\"\\");
++}
++
++/* imap_quote_string_and_backquotes: quote string according to IMAP rules:
++ *   surround string with quotes, escape " and \ with \.
++ * Additionally, escape backquotes with \ to protect against code injection
++ * when using the resulting string in mutt_parse_rc_line().
++ */
++void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src)
++{
++  _imap_quote_string (dest, dlen, src, "\"\\`");
++}
++
+ /* imap_unquote_string: equally stupid unquoting routine */
+ void imap_unquote_string (char *s)
+ {
+-- 
+2.18.0
+

mutt-1.9.2-sanitize_pop_paths.patch

@@ -0,0 +1,100 @@
+From 6aed28b40a0410ec47d40c8c7296d8d10bae7576 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 11:16:33 -0700
+Subject: [PATCH] Sanitize POP bcache paths.
+
+Protect against bcache directory path traversal for UID values.
+
+Thanks for Jeriko One for the bug report and patch, which this commit
+is based upon.
+---
+ pop.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/pop.c b/pop.c
+index d9d95fbe..288166de 100644
+--- a/pop.c
++++ b/pop.c
+@@ -40,6 +40,25 @@
+ #define HC_FEXT		"hcache"	/* extension for hcache as POP lacks paths */
+ #endif
+ 
++/**
++ * cache_id - Make a message-cache-compatible id
++ * @param id POP message id
++ * @retval ptr Sanitised string
++ *
++ * The POP message id may contain '/' and other awkward characters.
++ *
++ * @note This function returns a pointer to a static buffer.
++ */
++static const char *cache_id(const char *id)
++{
++  static char clean[SHORT_STRING];
++
++  strfcpy (clean, id, sizeof(clean));
++  mutt_sanitize_filename (clean, 1);
++
++  return clean;
++}
++
+ /* write line to file */
+ static int fetch_message (char *line, void *file)
+ {
+@@ -205,7 +224,7 @@ static int msg_cache_check (const char *id, body_cache_t *bcache, void *data)
+   /* message not found in context -> remove it from cache
+    * return the result of bcache, so we stop upon its first error
+    */
+-  return mutt_bcache_del (bcache, id);
++  return mutt_bcache_del (bcache, cache_id (id));
+ }
+ 
+ #ifdef USE_HCACHE
+@@ -355,7 +374,7 @@ static int pop_fetch_headers (CONTEXT *ctx)
+        *        - if we also have a body: read
+        *        - if we don't have a body: new
+        */
+-      bcached = mutt_bcache_exists (pop_data->bcache, ctx->hdrs[i]->data) == 0;
++      bcached = mutt_bcache_exists (pop_data->bcache, cache_id (ctx->hdrs[i]->data)) == 0;
+       ctx->hdrs[i]->old = 0;
+       ctx->hdrs[i]->read = 0;
+       if (hcached)
+@@ -531,7 +550,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno)
+   unsigned short bcache = 1;
+ 
+   /* see if we already have the message in body cache */
+-  if ((msg->fp = mutt_bcache_get (pop_data->bcache, h->data)))
++  if ((msg->fp = mutt_bcache_get (pop_data->bcache, cache_id (h->data))))
+     return 0;
+ 
+   /*
+@@ -578,7 +597,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno)
+ 			MUTT_PROGRESS_SIZE, NetInc, h->content->length + h->content->offset - 1);
+ 
+     /* see if we can put in body cache; use our cache as fallback */
+-    if (!(msg->fp = mutt_bcache_put (pop_data->bcache, h->data, 1)))
++    if (!(msg->fp = mutt_bcache_put (pop_data->bcache, cache_id (h->data), 1)))
+     {
+       /* no */
+       bcache = 0;
+@@ -624,7 +643,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno)
+    * portion of the headers, those required for the main display.
+    */
+   if (bcache)
+-    mutt_bcache_commit (pop_data->bcache, h->data);
++    mutt_bcache_commit (pop_data->bcache, cache_id (h->data));
+   else
+   {
+     cache->index = h->index;
+@@ -704,7 +723,7 @@ static int pop_sync_mailbox (CONTEXT *ctx, int *index_hint)
+ 	snprintf (buf, sizeof (buf), "DELE %d\r\n", ctx->hdrs[i]->refno);
+ 	if ((ret = pop_query (pop_data, buf, sizeof (buf))) == 0)
+ 	{
+-	  mutt_bcache_del (pop_data->bcache, ctx->hdrs[i]->data);
++	  mutt_bcache_del (pop_data->bcache, cache_id (ctx->hdrs[i]->data));
+ #if USE_HCACHE
+ 	  mutt_hcache_delete (hc, ctx->hdrs[i]->data, strlen);
+ #endif
+-- 
+2.18.0
+

mutt-1.9.2-selectively_cache_headers.patch

@@ -0,0 +1,39 @@
+From 31eef6c766f47df8281942d19f76e35f475c781d Mon Sep 17 00:00:00 2001
+From: Richard Russon <rich@flatcap.org>
+Date: Fri, 13 Jul 2018 11:33:16 -0700
+Subject: [PATCH] Selectively cache headers.
+
+Thanks to NeoMutt and Jeriko One for the patch, which was slightly
+modified to apply to the Mutt code.
+---
+ imap/util.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/imap/util.c b/imap/util.c
+index 27792944..d4cc2742 100644
+--- a/imap/util.c
++++ b/imap/util.c
+@@ -84,6 +84,7 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
+   ciss_url_t url;
+   char cachepath[LONG_STRING];
+   char mbox[LONG_STRING];
++  size_t len;
+ 
+   if (path)
+     imap_cachepath (idata, path, mbox, sizeof (mbox));
+@@ -96,6 +97,12 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
+     FREE (&mx.mbox);
+   }
+ 
++  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
++    return NULL;
++  len = strlen(mbox);
++  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
++    return NULL;
++
+   mutt_account_tourl (&idata->conn->account, &url);
+   url.path = mbox;
+   url_ciss_tostring (&url, cachepath, sizeof (cachepath), U_PATH);
+-- 
+2.18.0
+

mutt.spec

@@ -19,7 +19,7 @@
 Summary: A text mode mail user agent
 Name: mutt
 Version: 1.9.2
-Release: 1%{?dist}
+Release: 2%{?dist}
 Epoch: 5
 # The entire source code is GPLv2+ except
 # pgpewrap.c setenv.c sha1.c wcwidth.c which are Public Domain
@@ -35,6 +35,34 @@ Patch3: mutt-1.7.0-syncdebug.patch
 # FIXME make it to upstream
 Patch8: mutt-1.5.23-system_certs.patch
 Patch9: mutt-1.9.0-ssl_ciphers.patch
+
+# CVE-2018-14354 CVE-2018-14357
+Patch10: mutt-1.9.2-quote_mbox_names.patch
+
+# CVE-2018-14362
+Patch11: mutt-1.9.2-sanitize_pop_paths.patch
+
+# CVE-2018-14355
+Patch12: mutt-1.9.2-selectively_cache_headers.patch
+
+# CVE-2018-14349
+Patch13: mutt-1.9.2-Handle_NO_response_without_message_properly.patch
+
+# CVE-2018-14350 CVE-2018-14358
+Patch14: mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch
+
+# CVE-2018-14351
+Patch15: mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch
+
+# CVE-2018-14352 CVE-2018-14353
+Patch16: mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch
+
+# CVE-2018-14356
+Patch17: mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch
+
+# CVE-2018-14359
+Patch18: mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch
+
 Url: http://www.mutt.org
 Requires: mailcap, urlview
 BuildRequires: ncurses-devel, gettext, automake
@@ -84,6 +112,15 @@ autoreconf --install
 %patch3 -p1 -b .syncdebug
 %patch8 -p1 -b .system_certs
 %patch9 -p1 -b .ssl_ciphers
+%patch10 -p1 -b .quote_mbox_names
+%patch11 -p1 -b .sanitize_pop_paths
+%patch12 -p1 -b .selectively_cache_headers
+%patch13 -p1 -b .Handle_NO_response_without_message_properly
+%patch14 -p1 -b .Don_t_overflow_tmp_in_msg_parse_fetch
+%patch15 -p1 -b .Verify_IMAP_status_mailbox_literal_count_size
+%patch16 -p1 -b .Fix_imap_quote_string_length_check_errors
+%patch17 -p1 -b .Ensure_UID_in_fetch_uidl
+%patch18 -p1 -b .Check_outbuf_length_in_mutt_from_base64
 
 sed -i -r 's/`$GPGME_CONFIG --libs`/"\0 -lgpg-error"/' configure
 # disable mutt_dotlock program - remove support from mutt binary
@@ -196,6 +233,16 @@ ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5
 
 
 %changelog
+* Thu Jul 19 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.2-2
+- Backport security patches from mutt-1.10.1
+- Resolves: #1602082 (CVE-2018-14354, CVE-2018-14355, CVE-2018-14362)
+- Resolves: #1602916 (CVE-2018-14357)
+- Resolves: #1602923 (CVE-2018-14350)
+- Resolves: #1602935 (CVE-2018-14349)
+- Resolves: #1602954 (CVE-2018-14351)
+- Resolves: CVE-2018-14358, CVE-2018-14352, CVE-2018-14353, CVE-2018-14356,
+  CVE-2018-14359
+
 * Wed Dec 20 2017 Matej Mužila <mmuzila@redhat.com> - 5:1.9.2-1
 - Upgrade to 1.9.2