Backport security patches from mutt-1.10.1

Resolves: #1602082 (CVE-2018-14354, CVE-2018-14355, CVE-2018-14362) Resolves: #1602916 (CVE-2018-14357) Resolves: #1602923 (CVE-2018-14350) Resolves: #1602935 (CVE-2018-14349) Resolves: #1602954 (CVE-2018-14351) Resolves: CVE-2018-14358, CVE-2018-14352, CVE-2018-14353, CVE-2018-14356, CVE-2018-14359
2018-07-19 14:56:21 +02:00
24 changed files with 699 additions and 498 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -15,48 +15,3 @@ mutt-1.5.23.tar.gz
 /mutt-1.9.0.tar.gz
 /mutt-1.9.1.tar.gz
 /mutt-1.9.2.tar.gz
-/mutt-1.9.3.tar.gz
-/mutt-1.9.4.tar.gz
-/mutt-1.9.5.tar.gz
-/mutt-1.10.0.tar.gz
-/mutt-1.10.1.tar.gz
-/mutt-1.11.2.tar.gz
-/mutt-1.11.3.tar.gz
-/mutt-1.11.4.tar.gz
-/mutt-1.12.0.tar.gz
-/mutt-1.12.1.tar.gz
-/mutt-1.12.2.tar.gz
-/mutt-1.13.0.tar.gz
-/mutt-1.13.2.tar.gz
-/mutt-1.13.3.tar.gz
-/mutt-1.13.4.tar.gz
-/mutt-1.13.5.tar.gz
-/mutt-1.14.0.tar.gz
-/mutt-1.14.2.tar.gz
-/mutt-1.14.3.tar.gz
-/mutt-1.14.4.tar.gz
-/mutt-1.14.5.tar.gz
-/mutt-1.14.6.tar.gz
-/mutt-1.14.7.tar.gz
-/mutt-2.0.2.tar.gz
-/mutt-2.0.5.tar.gz
-/mutt-2.0.6.tar.gz
-/mutt-2.0.7.tar.gz
-/mutt-2.1.1.tar.gz
-/mutt-2.1.3.tar.gz
-/mutt-2.1.5.tar.gz
-/mutt-2.2.0.tar.gz
-/mutt-2.2.1.tar.gz
-/mutt-2.2.2.tar.gz
-/mutt-2.2.3.tar.gz
-/mutt-2.2.5.tar.gz
-/mutt-2.2.6.tar.gz
-/mutt-2.2.7.tar.gz
-/mutt-2.2.9.tar.gz
-/mutt-2.2.10.tar.gz
-/mutt-2.2.11.tar.gz
-/mutt-2.2.12.tar.gz
-/mutt-2.2.13.tar.gz
-/mutt-2.2.14.tar.gz
-/mutt-2.2.15.tar.gz
-/mutt-2.2.16.tar.gz
--- a/ci.fmf
+++ b/ci.fmf
@ -1,9 +0,0 @@
-/test:
-    summary:
-        Basic set of quick tests for mutt.
-    discover:
-      - name: fedora
-        how: fmf
-        url: "https://src.fedoraproject.org/tests/mutt.git"
-    execute:
-        how: tmt
--- a/mutt-1.12.1-optusegpgagent.patch
+++ b/mutt-1.12.1-optusegpgagent.patch
@ -1,12 +0,0 @@
-diff -up mutt-1.12.1/init.h.optusegpgagent mutt-1.12.1/init.h
--- mutt-1.12.1/init.h.optusegpgagent	2019-08-29 09:29:38.868810511 +0200
-+++ mutt-1.12.1/init.h	2019-08-29 09:30:29.899395370 +0200
-@@ -2444,7 +2444,7 @@ struct option_t MuttVars[] = {
-   ** not used.
-   ** (PGP only)
-   */
-  { "pgp_use_gpg_agent", DT_BOOL, R_NONE, {.l=OPTUSEGPGAGENT}, {.l=1} },
-+  { "pgp_use_gpg_agent", DT_BOOL, R_NONE, {.l=OPTUSEGPGAGENT}, {.l=0} },
-   /*
-   ** .pp
-   ** If \fIset\fP, mutt expects a \fCgpg-agent(1)\fP process will handle
--- a/mutt-1.5.23-sendlib.patch
+++ b/mutt-1.5.23-sendlib.patch
@ -0,0 +1,43 @@
+# HG changeset patch
+# User Kevin McCarthy <kevin@8t8.us>
+# Date 1417472364 28800
+#      Mon Dec 01 14:19:24 2014 -0800
+# Branch stable
+# Node ID 54c59aaf88b9f6b50f1078fc6f7551fa9315ac3e
+# Parent  1b583341d5ad677c8a1935eb4110eba27606878a
+Revert write_one_header() to skip space and tab.  (closes #3716)
+
+This patch fixes CVE-2014-9116 in the stable branch.  It reverts
+write_one_header() to the pre [f251d523ca5a] code for skipping
+whitespace.
+
+Thanks to Antonio Radici and Tomas Hoger for their analysis and patches
+to mutt, which this patch is based off of.
+
+diff --git a/sendlib.c b/sendlib.c
+--- a/sendlib.c
+++ b/sendlib.c
+@@ -1809,17 +1809,22 @@
+     {
+       tagbuf = NULL;
+       valbuf = mutt_substrdup (start, end);
+     }
+     else
+     {
+       tagbuf = mutt_substrdup (start, t);
+       /* skip over the colon separating the header field name and value */
+-      t = skip_email_wsp(t + 1);
+      ++t;
+
+      /* skip over any leading whitespace (WSP, as defined in RFC5322) */
+      while (*t == ' ' || *t == '\t')
+        t++;
+
+       valbuf = mutt_substrdup (t, end);
+     }
+     dprint(4,(debugfile,"mwoh: buf[%s%s] too long, "
+ 	      "max width = %d > %d\n",
+ 	      NONULL(pfx), valbuf, max, wraplen));
+     if (fold_one_header (fp, tagbuf, valbuf, pfx, wraplen, flags) < 0)
+       return -1;
+     FREE (&tagbuf);
--- a/mutt-1.5.23-system_certs.patch
+++ b/mutt-1.5.23-system_certs.patch
@ -1,21 +1,12 @@
-diff -up mutt-2.2.14/init.h.system_certs mutt-2.2.14/init.h
--- mutt-2.2.14/init.h.system_certs	2025-02-20 06:31:10.000000000 +0100
-+++ mutt-2.2.14/init.h	2025-07-22 23:31:06.259171517 +0200
-@@ -4315,7 +4315,7 @@ struct option_t MuttVars[] = {
+diff -rup mutt-17a4f92e4a95-orig/init.h mutt-17a4f92e4a95-new/init.h
+--- mutt-17a4f92e4a95-orig/init.h	2015-06-07 22:59:32.000000000 +0200
+++ mutt-17a4f92e4a95-new/init.h	2015-06-25 15:28:56.095570332 +0200
+@@ -2989,7 +2989,7 @@ struct option_t MuttVars[] = {
   */
 #if defined(USE_SSL)
- # ifdef USE_SSL_GNUTLS
-  { "ssl_ca_certificates_file", DT_PATH, R_NONE, {.p=&SslCACertFile}, {.p=0} },
-+  { "ssl_ca_certificates_file", DT_PATH, R_NONE, {.p=&SslCACertFile}, {.p="/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"} },
+ #ifdef USE_SSL_GNUTLS
+-  { "ssl_ca_certificates_file", DT_PATH, R_NONE, UL &SslCACertFile, 0 },
+  { "ssl_ca_certificates_file", DT_PATH, R_NONE, UL &SslCACertFile, "/etc/ssl/certs/ca-bundle.crt" },
   /*
   ** .pp
   ** This variable specifies a file containing trusted CA certificates.
-@@ -4324,7 +4324,7 @@ struct option_t MuttVars[] = {
-   ** .pp
-   ** Example:
-   ** .ts
-  ** set ssl_ca_certificates_file=/etc/ssl/certs/ca-certificates.crt
-+  ** set ssl_ca_certificates_file=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
-   ** .te
-   */
- # endif /* USE_SSL_GNUTLS */
--- a/mutt-1.8.0-cabundle.patch
+++ b/mutt-1.8.0-cabundle.patch
@ -1,15 +1,15 @@
 diff -ur mutt-1.8.0.orig/contrib/Makefile.am mutt-1.8.0/contrib/Makefile.am
 --- mutt-1.8.0.orig/contrib/Makefile.am	2017-02-25 15:28:22.124997366 +0000
 +++ mutt-1.8.0/contrib/Makefile.am	2017-02-25 15:48:10.834036861 +0000
-@@ -6,7 +6,7 @@
+@@ -5,7 +5,7 @@
+ SAMPLES = Mush.rc Pine.rc gpg.rc pgp2.rc pgp5.rc pgp6.rc Tin.rc \
 	sample.mailcap sample.muttrc sample.muttrc-sidebar sample.muttrc-tlr \
- 	sample.muttrc-compress sample.muttrc-starter \
- 	sample.vimrc-sidebar colors.default colors.linux smime.rc \
-	ca-bundle.crt smime_keys_test.pl mutt_xtitle markdown2html \
-+	smime_keys_test.pl mutt_xtitle markdown2html \
- 	bgedit-detectgui.sh bgedit-screen-tmux.sh \
- 	mutt_oauth2.py mutt_oauth2.py.README
+ 	sample.muttrc-compress sample.vimrc-sidebar colors.default colors.linux smime.rc \
+-	ca-bundle.crt smime_keys_test.pl mutt_xtitle
+	smime_keys_test.pl mutt_xtitle
 
+ EXTRA_DIST = language.txt language50.txt  \
+ 	patch.slang-1.2.2.keypad.1	\
 diff -ur mutt-1.8.0.orig/doc/smime-notes.txt mutt-1.8.0/doc/smime-notes.txt
 --- mutt-1.8.0.orig/doc/smime-notes.txt	2017-02-25 15:28:22.119997501 +0000
 +++ mutt-1.8.0/doc/smime-notes.txt	2017-02-25 16:06:38.986242390 +0000
--- a/mutt-1.10.0-muttrc.patch
+++ b/mutt-1.10.0-muttrc.patch
@ -1,7 +1,7 @@
 diff -ur mutt-1.8.0.orig/doc/Muttrc.head mutt-1.8.0/doc/Muttrc.head
 --- mutt-1.8.0.orig/doc/Muttrc.head	2017-02-25 15:28:22.120997474 +0000
 +++ mutt-1.8.0/doc/Muttrc.head	2017-02-25 15:30:10.643079681 +0000
-@@ -24,13 +24,17 @@
+@@ -24,11 +24,15 @@
 
 # Show documentation when pressing F1
 macro generic,pager <F1> "<shell-escape> less @docdir@/manual.txt<Enter>" "show Mutt documentation"
@ -9,9 +9,7 @@ diff -ur mutt-1.8.0.orig/doc/Muttrc.head mutt-1.8.0/doc/Muttrc.head
 +macro generic,pager <F2> "<shell-escape> less @docdir@/manual.txt<Enter>" "show Mutt documentation"
 
 # show the incoming mailboxes list (just like "mutt -y") and back when pressing "y"
- # note: these macros have been subsumed by the <browse-mailboxes> function.
- # macro index y "<change-folder>?<toggle-mailboxes>" "show incoming mailboxes list"
- # macro pager y "<exit><change-folder>?<toggle-mailboxes>" "show incoming mailboxes list"
+ macro index,pager y "<change-folder>?<toggle-mailboxes>" "show incoming mailboxes list"
 bind browser y exit
 
 +bind editor <delete> delete-char
--- a/mutt-1.9.0-ssl_ciphers.patch
+++ b/mutt-1.9.0-ssl_ciphers.patch
@ -5,28 +5,28 @@ diff -ur mutt-1.9.0.orig/init.h mutt-1.9.0/init.h
   */
 #  endif /* defined HAVE_SSL_PARTIAL_CHAIN */
 # endif /* defined USE_SSL_OPENSSL */
-  { "ssl_ciphers", DT_STR, R_NONE, {.p=&SslCiphers}, {.p=0} },
-+  { "ssl_ciphers", DT_STR, R_NONE, {.p=&SslCiphers}, {.p="@SYSTEM"} },
+-  { "ssl_ciphers", DT_STR, R_NONE, UL &SslCiphers, UL 0 },
+  { "ssl_ciphers", DT_STR, R_NONE, UL &SslCiphers, UL "@SYSTEM" },
   /*
   ** .pp
-   ** Contains a colon-separated list of ciphers to use when using SSL.
+   ** Contains a colon-seperated list of ciphers to use when using SSL.
 diff -ur mutt-1.9.0.orig/mutt_ssl_gnutls.c mutt-1.9.0/mutt_ssl_gnutls.c
 --- mutt-1.9.0.orig/mutt_ssl_gnutls.c	2017-09-04 16:48:21.403528134 +0200
 +++ mutt-1.9.0/mutt_ssl_gnutls.c	2017-09-04 16:51:16.081679141 +0200
@@ -286,6 +286,8 @@
   else
-     mutt_buffer_strcpy (priority, "NORMAL");
+     safe_strcat (priority, priority_size, "NORMAL");
 
 +if (SslCiphers && strcmp(SslCiphers, "@SYSTEM"))
 +{
-   if (!option (OPTTLSV1_3))
+   if (! option(OPTTLSV1_2))
   {
     nproto--;
@@ -313,6 +315,7 @@
-     mutt_error (_("All available protocols for TLS/SSL connection disabled"));
-     goto cleanup;
+     FREE (&priority);
+     return -1;
   }
 +}
 
-   if ((err = gnutls_priority_set_direct (data->state, mutt_b2s (priority), NULL)) < 0)
+   if ((err = gnutls_priority_set_direct (data->state, priority, NULL)) < 0)
   {
--- a/mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch
+++ b/mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch
@ -0,0 +1,100 @@
+From 3d9028fec8f4d08db2251096307c0bbbebce669a Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 14:25:28 -0700
+Subject: [PATCH] Check outbuf length in mutt_from_base64()
+
+The obuf can be overflowed in auth_cram.c, and possibly auth_gss.c.
+
+Thanks to Jeriko One for the bug report.
+---
+ base64.c         | 8 +++++++-
+ imap/auth_cram.c | 2 +-
+ imap/auth_gss.c  | 4 ++--
+ protos.h         | 2 +-
+ 4 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/base64.c b/base64.c
+index fd3ffb88..120d4baa 100644
+--- a/base64.c
+++ b/base64.c
+@@ -81,7 +81,7 @@ void mutt_to_base64 (unsigned char *out, const unsigned char *in, size_t len,
+ 
+ /* Convert '\0'-terminated base 64 string to raw bytes.
+  * Returns length of returned buffer, or -1 on error */
+-int mutt_from_base64 (char *out, const char *in)
+int mutt_from_base64 (char *out, const char *in, size_t olen)
+ {
+   int len = 0;
+   register unsigned char digit1, digit2, digit3, digit4;
+@@ -103,14 +103,20 @@ int mutt_from_base64 (char *out, const char *in)
+     in += 4;
+ 
+     /* digits are already sanity-checked */
+    if (len == olen)
+      return len;
+     *out++ = (base64val(digit1) << 2) | (base64val(digit2) >> 4);
+     len++;
+     if (digit3 != '=')
+     {
+      if (len == olen)
+        return len;
+       *out++ = ((base64val(digit2) << 4) & 0xf0) | (base64val(digit3) >> 2);
+       len++;
+       if (digit4 != '=')
+       {
+        if (len == olen)
+          return len;
+ 	*out++ = ((base64val(digit3) << 6) & 0xc0) | base64val(digit4);
+ 	len++;
+       }
+diff --git a/imap/auth_cram.c b/imap/auth_cram.c
+index 9b6db9af..87617215 100644
+--- a/imap/auth_cram.c
+++ b/imap/auth_cram.c
+@@ -71,7 +71,7 @@ imap_auth_res_t imap_auth_cram_md5 (IMAP_DATA* idata, const char* method)
+     goto bail;
+   }
+ 
+-  if ((len = mutt_from_base64 (obuf, idata->buf + 2)) == -1)
+  if ((len = mutt_from_base64 (obuf, idata->buf + 2, sizeof(obuf) - 1)) == -1)
+   {
+     dprint (1, (debugfile, "Error decoding base64 response.\n"));
+     goto bail;
+diff --git a/imap/auth_gss.c b/imap/auth_gss.c
+index a08e7c20..e14f4aac 100644
+--- a/imap/auth_gss.c
+++ b/imap/auth_gss.c
+@@ -197,7 +197,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA* idata, const char* method)
+       goto bail;
+     }
+ 
+-    request_buf.length = mutt_from_base64 (buf2, idata->buf + 2);
+    request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2));
+     request_buf.value = buf2;
+     sec_token = &request_buf;
+ 
+@@ -233,7 +233,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA* idata, const char* method)
+     dprint (1, (debugfile, "Error receiving server response.\n"));
+     goto bail;
+   }
+-  request_buf.length = mutt_from_base64 (buf2, idata->buf + 2);
+  request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2));
+   request_buf.value = buf2;
+ 
+   maj_stat = gss_unwrap (&min_stat, context, &request_buf, &send_token,
+diff --git a/protos.h b/protos.h
+index 8bcda67f..f933e925 100644
+--- a/protos.h
+++ b/protos.h
+@@ -397,7 +397,7 @@ ADDRESS *alias_reverse_lookup (ADDRESS *);
+ 
+ /* base64.c */
+ void mutt_to_base64 (unsigned char*, const unsigned char*, size_t, size_t);
+-int mutt_from_base64 (char*, const char*);
+int mutt_from_base64 (char*, const char*, size_t);
+ 
+ /* utf8.c */
+ int mutt_wctoutf8 (char *s, unsigned int c, size_t buflen);
+-- 
+2.13.6
+
--- a/mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch
+++ b/mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch
@ -0,0 +1,56 @@
+From 3287534daa3beac68e2e83ca4b4fe8a3148ff870 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 12:15:00 -0700
+Subject: [PATCH] Don't overflow tmp in msg_parse_fetch.
+
+Ensure INTERNALDATE and RFC822.SIZE field sizes fit temp buffer.
+
+Thanks to Jeriko One for the bug report and patch, which this patch is
+based upon.
+---
+ imap/message.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/imap/message.c b/imap/message.c
+index 9ebfeb8e..e6056555 100644
+--- a/imap/message.c
+++ b/imap/message.c
+@@ -1345,6 +1345,7 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
+ {
+   char tmp[SHORT_STRING];
+   char *ptmp;
+  size_t dlen;
+ 
+   if (!s)
+     return -1;
+@@ -1378,8 +1379,12 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
+       }
+       s++;
+       ptmp = tmp;
+-      while (*s && *s != '\"')
+      dlen = sizeof(tmp) - 1;
+      while (*s && *s != '\"' && dlen)
+      {
+         *ptmp++ = *s++;
+        dlen--;
+      }
+       if (*s != '\"')
+         return -1;
+       s++; /* skip past the trailing " */
+@@ -1391,8 +1396,12 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s)
+       s += 11;
+       SKIPWS (s);
+       ptmp = tmp;
+-      while (isdigit ((unsigned char) *s))
+      dlen = sizeof(tmp) - 1;
+      while (isdigit ((unsigned char) *s) && dlen)
+      {
+         *ptmp++ = *s++;
+        dlen--;
+      }
+       *ptmp = 0;
+       h->content_length = atoi (tmp);
+     }
+-- 
+2.13.6
+
--- a/mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch
+++ b/mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch
@ -0,0 +1,27 @@
+From e154cba1b3fc52bb8cb8aa846353c0db79b5d9c6 Mon Sep 17 00:00:00 2001
+From: JerikoOne <jeriko.one@gmx.us>
+Date: Fri, 13 Jul 2018 10:47:11 -0700
+Subject: [PATCH] Ensure UID in fetch_uidl.
+
+---
+ pop.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/pop.c b/pop.c
+index ecfd8d7c..d9d95fbe 100644
+--- a/pop.c
+++ b/pop.c
+@@ -152,6 +152,10 @@ static int fetch_uidl (char *line, void *data)
+       endp++;
+   memmove(line, endp, strlen(endp) + 1);
+ 
+  /* uid must be at least be 1 byte */
+  if (strlen(line) == 0)
+    return -1;
+
+   for (i = 0; i < ctx->msgcount; i++)
+     if (!mutt_strcmp (line, ctx->hdrs[i]->data))
+       break;
+-- 
+2.13.6
+
--- a/mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch
+++ b/mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch
@ -0,0 +1,55 @@
+From e0131852c6059107939893016c8ff56b6e42865d Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Thu, 12 Jul 2018 20:46:37 -0700
+Subject: [PATCH] Fix imap_quote_string() length check errors.
+
+The function wasn't properly checking for dlen<2 before quoting, and
+wasn't properly pre-adjusting dlen to include the initial quote.
+
+Thanks to Jeriko One for reporting these issues.
+---
+ imap/util.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/imap/util.c b/imap/util.c
+index 3274a70c..27792944 100644
+--- a/imap/util.c
+++ b/imap/util.c
+@@ -614,20 +614,29 @@ static void _imap_quote_string (char *dest, size_t dlen, const char *src,
+   char *pt;
+   const char *s;
+ 
+  if (!(dest && dlen && src && to_quote))
+    return;
+
+  if (dlen < 3)
+  {
+    *dest = 0;
+    return;
+  }
+
+   pt = dest;
+   s  = src;
+ 
+-  *pt++ = '"';
+-  /* save room for trailing quote-char */
+-  dlen -= 2;
+  /* save room for pre/post quote-char and trailing null */
+  dlen -= 3;
+ 
+  *pt++ = '"';
+   for (; *s && dlen; s++)
+   {
+     if (strchr (to_quote, *s))
+     {
+      if (dlen < 2)
+        break;
+       dlen -= 2;
+-      if (!dlen)
+-	break;
+       *pt++ = '\\';
+       *pt++ = *s;
+     }
+-- 
+2.13.6
+
--- a/mutt-1.9.2-Handle_NO_response_without_message_properly.patch
+++ b/mutt-1.9.2-Handle_NO_response_without_message_properly.patch
@ -0,0 +1,25 @@
+From 9347b5c01dc52682cb6be11539d9b7ebceae4416 Mon Sep 17 00:00:00 2001
+From: JerikoOne <jeriko.one@gmx.us>
+Date: Fri, 13 Jul 2018 12:24:58 -0700
+Subject: [PATCH] Handle NO response without message properly
+
+---
+ imap/command.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/imap/command.c b/imap/command.c
+index 82bf54c4..bb267f62 100644
+--- a/imap/command.c
+++ b/imap/command.c
+@@ -586,7 +586,7 @@ static int cmd_handle_untagged (IMAP_DATA* idata)
+     dprint (2, (debugfile, "Handling untagged NO\n"));
+ 
+     /* Display the warning message from the server */
+-    mutt_error ("%s", s+3);
+    mutt_error ("%s", s+2);
+     mutt_sleep (2);
+   }
+ 
+-- 
+2.13.6
+
--- a/mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch
+++ b/mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch
@ -0,0 +1,34 @@
+From e57a8602b45f58edf7b3ffb61bb17525d75dfcb1 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 12:35:50 -0700
+Subject: [PATCH] Verify IMAP status mailbox literal count size.
+
+Ensure the length isn't bigger than the idata->buf.
+
+Thanks to Jeriko One fo the bug report and patch, which this commit is
+based upon.
+---
+ imap/command.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/imap/command.c b/imap/command.c
+index bb267f62..6abd759d 100644
+--- a/imap/command.c
+++ b/imap/command.c
+@@ -969,6 +969,13 @@ static void cmd_parse_status (IMAP_DATA* idata, char* s)
+       idata->status = IMAP_FATAL;
+       return;
+     }
+
+    if (strlen(idata->buf) < litlen)
+    {
+      dprint (1, (debugfile, "Error parsing STATUS mailbox\n"));
+      return;
+    }
+
+     mailbox = idata->buf;
+     s = mailbox + litlen;
+     *s = '\0';
+-- 
+2.13.6
+
--- a/mutt-1.9.2-quote_mbox_names.patch
+++ b/mutt-1.9.2-quote_mbox_names.patch
@ -0,0 +1,127 @@
+From 185152818541f5cdc059cbff3f3e8b654fc27c1d Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Sat, 7 Jul 2018 19:03:44 -0700
+Subject: [PATCH] Properly quote IMAP mailbox names when (un)subscribing.
+
+When handling automatic subscription (via $imap_check_subscribed), or
+manual subscribe/unsubscribe commands, mutt generating a "mailboxes"
+command but failed to properly escape backquotes.
+
+Thanks to Jeriko One for the detailed bug report and patch, which this
+commit is based upon.
+---
+ imap/command.c      |  5 +++--
+ imap/imap.c         |  7 +++++--
+ imap/imap_private.h |  3 ++-
+ imap/util.c         | 25 ++++++++++++++++++++-----
+ 4 files changed, 30 insertions(+), 10 deletions(-)
+
+diff --git a/imap/command.c b/imap/command.c
+index c8825981..c79d4f28 100644
+--- a/imap/command.c
+++ b/imap/command.c
+@@ -842,8 +842,9 @@ static void cmd_parse_lsub (IMAP_DATA* idata, char* s)
+ 
+   strfcpy (buf, "mailboxes \"", sizeof (buf));
+   mutt_account_tourl (&idata->conn->account, &url);
+-  /* escape \ and " */
+-  imap_quote_string(errstr, sizeof (errstr), list.name);
+  /* escape \ and ". Also escape ` because the resulting
+   * string will be passed to mutt_parse_rc_line. */
+  imap_quote_string_and_backquotes (errstr, sizeof (errstr), list.name);
+   url.path = errstr + 1;
+   url.path[strlen(url.path) - 1] = '\0';
+   if (!mutt_strcmp (url.user, ImapUser))
+diff --git a/imap/imap.c b/imap/imap.c
+index 668203b8..c3a8ffd0 100644
+--- a/imap/imap.c
+++ b/imap/imap.c
+@@ -1930,6 +1930,7 @@ int imap_subscribe (char *path, int subscribe)
+   char buf[LONG_STRING];
+   char mbox[LONG_STRING];
+   char errstr[STRING];
+  int mblen;
+   BUFFER err, token;
+   IMAP_MBOX mx;
+ 
+@@ -1951,8 +1952,10 @@ int imap_subscribe (char *path, int subscribe)
+     mutt_buffer_init (&err);
+     err.data = errstr;
+     err.dsize = sizeof (errstr);
+-    snprintf (mbox, sizeof (mbox), "%smailboxes \"%s\"",
+-              subscribe ? "" : "un", path);
+    mblen = snprintf (mbox, sizeof (mbox), "%smailboxes ",
+                      subscribe ? "" : "un");
+    imap_quote_string_and_backquotes (mbox + mblen, sizeof(mbox) - mblen,
+                                      path);
+     if (mutt_parse_rc_line (mbox, &token, &err))
+       dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", errstr));
+     FREE (&token.data);
+diff --git a/imap/imap_private.h b/imap/imap_private.h
+index 312fbfe4..349c5a49 100644
+--- a/imap/imap_private.h
+++ b/imap/imap_private.h
+@@ -301,7 +301,8 @@ char* imap_next_word (char* s);
+ time_t imap_parse_date (char* s);
+ void imap_make_date (char* buf, time_t timestamp);
+ void imap_qualify_path (char *dest, size_t len, IMAP_MBOX *mx, char* path);
+-void imap_quote_string (char* dest, size_t slen, const char* src);
+void imap_quote_string (char* dest, size_t dlen, const char* src);
+void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src);
+ void imap_unquote_string (char* s);
+ void imap_munge_mbox_name (IMAP_DATA *idata, char *dest, size_t dlen, const char *src);
+ void imap_unmunge_mbox_name (IMAP_DATA *idata, char *s);
+diff --git a/imap/util.c b/imap/util.c
+index 914c93c3..3274a70c 100644
+--- a/imap/util.c
+++ b/imap/util.c
+@@ -608,11 +608,9 @@ void imap_qualify_path (char *dest, size_t len, IMAP_MBOX *mx, char* path)
+ }
+ 
+ 
+-/* imap_quote_string: quote string according to IMAP rules:
+- *   surround string with quotes, escape " and \ with \ */
+-void imap_quote_string (char *dest, size_t dlen, const char *src)
+static void _imap_quote_string (char *dest, size_t dlen, const char *src,
+                                const char *to_quote)
+ {
+-  static const char quote[] = "\"\\";
+   char *pt;
+   const char *s;
+ 
+@@ -625,7 +623,7 @@ void imap_quote_string (char *dest, size_t dlen, const char *src)
+ 
+   for (; *s && dlen; s++)
+   {
+-    if (strchr (quote, *s))
+    if (strchr (to_quote, *s))
+     {
+       dlen -= 2;
+       if (!dlen)
+@@ -643,6 +641,23 @@ void imap_quote_string (char *dest, size_t dlen, const char *src)
+   *pt = 0;
+ }
+ 
+/* imap_quote_string: quote string according to IMAP rules:
+ *   surround string with quotes, escape " and \ with \ */
+void imap_quote_string (char *dest, size_t dlen, const char *src)
+{
+  _imap_quote_string (dest, dlen, src, "\"\\");
+}
+
+/* imap_quote_string_and_backquotes: quote string according to IMAP rules:
+ *   surround string with quotes, escape " and \ with \.
+ * Additionally, escape backquotes with \ to protect against code injection
+ * when using the resulting string in mutt_parse_rc_line().
+ */
+void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src)
+{
+  _imap_quote_string (dest, dlen, src, "\"\\`");
+}
+
+ /* imap_unquote_string: equally stupid unquoting routine */
+ void imap_unquote_string (char *s)
+ {
+-- 
+2.18.0
+
--- a/mutt-1.9.2-sanitize_pop_paths.patch
+++ b/mutt-1.9.2-sanitize_pop_paths.patch
@ -0,0 +1,100 @@
+From 6aed28b40a0410ec47d40c8c7296d8d10bae7576 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Fri, 13 Jul 2018 11:16:33 -0700
+Subject: [PATCH] Sanitize POP bcache paths.
+
+Protect against bcache directory path traversal for UID values.
+
+Thanks for Jeriko One for the bug report and patch, which this commit
+is based upon.
+---
+ pop.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/pop.c b/pop.c
+index d9d95fbe..288166de 100644
+--- a/pop.c
+++ b/pop.c
+@@ -40,6 +40,25 @@
+ #define HC_FEXT		"hcache"	/* extension for hcache as POP lacks paths */
+ #endif
+ 
+/**
+ * cache_id - Make a message-cache-compatible id
+ * @param id POP message id
+ * @retval ptr Sanitised string
+ *
+ * The POP message id may contain '/' and other awkward characters.
+ *
+ * @note This function returns a pointer to a static buffer.
+ */
+static const char *cache_id(const char *id)
+{
+  static char clean[SHORT_STRING];
+
+  strfcpy (clean, id, sizeof(clean));
+  mutt_sanitize_filename (clean, 1);
+
+  return clean;
+}
+
+ /* write line to file */
+ static int fetch_message (char *line, void *file)
+ {
+@@ -205,7 +224,7 @@ static int msg_cache_check (const char *id, body_cache_t *bcache, void *data)
+   /* message not found in context -> remove it from cache
+    * return the result of bcache, so we stop upon its first error
+    */
+-  return mutt_bcache_del (bcache, id);
+  return mutt_bcache_del (bcache, cache_id (id));
+ }
+ 
+ #ifdef USE_HCACHE
+@@ -355,7 +374,7 @@ static int pop_fetch_headers (CONTEXT *ctx)
+        *        - if we also have a body: read
+        *        - if we don't have a body: new
+        */
+-      bcached = mutt_bcache_exists (pop_data->bcache, ctx->hdrs[i]->data) == 0;
+      bcached = mutt_bcache_exists (pop_data->bcache, cache_id (ctx->hdrs[i]->data)) == 0;
+       ctx->hdrs[i]->old = 0;
+       ctx->hdrs[i]->read = 0;
+       if (hcached)
+@@ -531,7 +550,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno)
+   unsigned short bcache = 1;
+ 
+   /* see if we already have the message in body cache */
+-  if ((msg->fp = mutt_bcache_get (pop_data->bcache, h->data)))
+  if ((msg->fp = mutt_bcache_get (pop_data->bcache, cache_id (h->data))))
+     return 0;
+ 
+   /*
+@@ -578,7 +597,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno)
+ 			MUTT_PROGRESS_SIZE, NetInc, h->content->length + h->content->offset - 1);
+ 
+     /* see if we can put in body cache; use our cache as fallback */
+-    if (!(msg->fp = mutt_bcache_put (pop_data->bcache, h->data, 1)))
+    if (!(msg->fp = mutt_bcache_put (pop_data->bcache, cache_id (h->data), 1)))
+     {
+       /* no */
+       bcache = 0;
+@@ -624,7 +643,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno)
+    * portion of the headers, those required for the main display.
+    */
+   if (bcache)
+-    mutt_bcache_commit (pop_data->bcache, h->data);
+    mutt_bcache_commit (pop_data->bcache, cache_id (h->data));
+   else
+   {
+     cache->index = h->index;
+@@ -704,7 +723,7 @@ static int pop_sync_mailbox (CONTEXT *ctx, int *index_hint)
+ 	snprintf (buf, sizeof (buf), "DELE %d\r\n", ctx->hdrs[i]->refno);
+ 	if ((ret = pop_query (pop_data, buf, sizeof (buf))) == 0)
+ 	{
+-	  mutt_bcache_del (pop_data->bcache, ctx->hdrs[i]->data);
+	  mutt_bcache_del (pop_data->bcache, cache_id (ctx->hdrs[i]->data));
+ #if USE_HCACHE
+ 	  mutt_hcache_delete (hc, ctx->hdrs[i]->data, strlen);
+ #endif
+-- 
+2.18.0
+
--- a/mutt-1.9.2-selectively_cache_headers.patch
+++ b/mutt-1.9.2-selectively_cache_headers.patch
@ -0,0 +1,39 @@
+From 31eef6c766f47df8281942d19f76e35f475c781d Mon Sep 17 00:00:00 2001
+From: Richard Russon <rich@flatcap.org>
+Date: Fri, 13 Jul 2018 11:33:16 -0700
+Subject: [PATCH] Selectively cache headers.
+
+Thanks to NeoMutt and Jeriko One for the patch, which was slightly
+modified to apply to the Mutt code.
+---
+ imap/util.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/imap/util.c b/imap/util.c
+index 27792944..d4cc2742 100644
+--- a/imap/util.c
+++ b/imap/util.c
+@@ -84,6 +84,7 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
+   ciss_url_t url;
+   char cachepath[LONG_STRING];
+   char mbox[LONG_STRING];
+  size_t len;
+ 
+   if (path)
+     imap_cachepath (idata, path, mbox, sizeof (mbox));
+@@ -96,6 +97,12 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
+     FREE (&mx.mbox);
+   }
+ 
+  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
+    return NULL;
+  len = strlen(mbox);
+  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
+    return NULL;
+
+   mutt_account_tourl (&idata->conn->account, &url);
+   url.path = mbox;
+   url_ciss_tostring (&url, cachepath, sizeof (cachepath), U_PATH);
+-- 
+2.18.0
+
--- a/mutt-1.9.4-lynx_no_backscapes.patch
+++ b/mutt-1.9.4-lynx_no_backscapes.patch
@ -1,12 +0,0 @@
-diff -up mutt-1.9.1/doc/Makefile.am.lynx_no_backscapes mutt-1.9.1/doc/Makefile.am
--- mutt-1.9.1/doc/Makefile.am.lynx_no_backscapes	2018-04-12 15:30:14.881812698 +0200
-+++ mutt-1.9.1/doc/Makefile.am	2018-04-12 15:30:25.632968018 +0200
-@@ -109,7 +109,7 @@ uninstall-local:
- 
- check:
- manual.txt: manual.html
-	-LC_ALL=C lynx -localhost -dump -nolist -nonumbers -with_backspaces -display_charset=us-ascii manual.html > $@ || \
-+	-LC_ALL=C lynx -localhost -dump -nolist -display_charset=us-ascii manual.html > $@ || \
- 	LC_ALL=C w3m -T text/html -I utf-8 -O utf-8 -dump < manual.html > $@ || \
- 	LC_ALL=C elinks -dump -no-numbering -no-references manual.html | sed -e 's,\\001, ,g' > $@
- 
--- a/mutt-1.9.5-nodotlock.patch
+++ b/mutt-1.9.5-nodotlock.patch
@ -1,43 +0,0 @@
-diff -up mutt-1.10.0/configure.ac.nodotlock mutt-1.10.0/configure.ac
--- mutt-1.10.0/configure.ac.nodotlock	2018-05-14 23:51:53.000000000 +0200
-+++ mutt-1.10.0/configure.ac	2018-05-23 15:09:21.186613968 +0200
-@@ -528,9 +528,7 @@ int main (int argc, char **argv)
- }]])],[mutt_cv_worldwrite=yes],[mutt_cv_worldwrite=no],[mutt_cv_worldwrite=no])])
- 
-         mutt_cv_setgid=no
-        if test $mutt_cv_worldwrite = yes; then
-                AC_DEFINE(USE_DOTLOCK,1,[ Define to use dotlocking for mailboxes. ])
-        else
-+        if test $mutt_cv_worldwrite != yes; then
- 
-                 AC_CACHE_CHECK(if $mutt_cv_mailpath is group writable, mutt_cv_groupwrite, [AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <sys/types.h>
- #include <sys/stat.h>
-@@ -546,7 +544,6 @@ int main (int argc, char **argv)
- }]])],[mutt_cv_groupwrite=yes],[mutt_cv_groupwrite=no],[mutt_cv_groupwrite=no])])
- 
-                 if test $mutt_cv_groupwrite = yes; then
-                        AC_DEFINE(USE_DOTLOCK,1,[ Define to use dotlocking for mailboxes. ])
-                         AC_DEFINE(USE_SETGID,1,[ Define if mutt should run setgid "mail". ])
-                         mutt_cv_setgid=yes
-                 fi
-diff -up mutt-1.10.0/Makefile.am.nodotlock mutt-1.10.0/Makefile.am
--- mutt-1.10.0/Makefile.am.nodotlock	2018-05-23 15:11:05.477977659 +0200
-+++ mutt-1.10.0/Makefile.am	2018-05-23 15:11:20.252170843 +0200
-@@ -154,17 +154,6 @@ hcversion.h: $(srcdir)/mutt.h $(srcdir)/
- patchlist.c: $(srcdir)/PATCHES $(srcdir)/patchlist.sh
- 	$(srcdir)/patchlist.sh < $(srcdir)/PATCHES > patchlist.c
- 
-install-exec-hook:
-	if test -f $(DESTDIR)$(bindir)/mutt.dotlock && test -f $(DESTDIR)$(bindir)/mutt_dotlock ; then	\
-		rm -f $(DESTDIR)$(bindir)/mutt.dotlock ;		\
-		ln -sf $(DESTDIR)$(bindir)/mutt_dotlock $(DESTDIR)$(bindir)/mutt.dotlock ; \
-	fi
-	if test -f $(DESTDIR)$(bindir)/mutt_dotlock && test x$(DOTLOCK_GROUP) != x ; then \
-		chgrp $(DOTLOCK_GROUP) $(DESTDIR)$(bindir)/mutt_dotlock && \
-		chmod $(DOTLOCK_PERMISSION) $(DESTDIR)$(bindir)/mutt_dotlock || \
-		{ echo "Can't fix mutt_dotlock's permissions!  This is required to lock mailboxes in the mail spool directory." >&2 ; exit 1 ; } \
-	fi
-
- install-data-local:
- 	$(MKDIR_P) $(DESTDIR)$(sysconfdir)
- 	$(INSTALL) -m 644 $(srcdir)/mime.types $(DESTDIR)$(sysconfdir)/mime.types.dist
--- a/mutt-configure-c99.patch
+++ b/mutt-configure-c99.patch
@ -1,24 +0,0 @@
-The standard iconv function uses char ** even for its input
-argument. With a const char ** argument, ICONV_NONTRANS is incorrectly
-set to 1 if the compiler produces an error for such incompatible
-pointer types.
-
-Submitted upstream: <https://gitlab.com/muttmua/mutt/-/merge_requests/175>
-
-diff --git a/configure.ac b/configure.ac
-index 9fe461df2a5af3a8..443da363081343c5 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -1322,10 +1322,10 @@ AC_CACHE_CHECK([whether iconv is non-transcribing], mutt_cv_iconv_nontrans,
- int main()
- {
-   iconv_t cd;
-  const char *ib;
-+  char *ib;
-   char *ob;
-   size_t ibl, obl;
-  const char *s = "\304\211";
-+  char *s = (char *) "\304\211";
- changequote(, )dnl
-   char t[3];
- changequote([, ])dnl
--- a/mutt.spec
+++ b/mutt.spec
@ -5,8 +5,7 @@
 %bcond_without gnutls
 %bcond_without gss
 %bcond_without sasl
-%bcond_with idn
-%bcond_without idn2
+%bcond_without idn
 %bcond_without hcache
 %bcond_without tokyocabinet
 %bcond_with bdb
@ -19,36 +18,59 @@

 Summary: A text mode mail user agent
 Name: mutt
-Version: 2.2.16
+Version: 1.9.2
 Release: 2%{?dist}
 Epoch: 5
 # The entire source code is GPLv2+ except
 # pgpewrap.c setenv.c sha1.c wcwidth.c which are Public Domain
-License: GPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain
+License: GPLv2+ and Public Domain
+Group: Applications/Internet
 # hg snapshot created from http://dev.mutt.org/hg/mutt
-Source: http://ftp.mutt.org/pub/%{name}/%{name}-%{version}.tar.gz
+Source: ftp://ftp.mutt.org/pub/%{name}/%{name}-%{version}.tar.gz
 Source1: mutt_ldap_query
-Patch1: mutt-1.10.0-muttrc.patch
+Patch1: mutt-1.8.0-muttrc.patch
 Patch2: mutt-1.8.0-cabundle.patch
 # https://dev.mutt.org/trac/ticket/3569
 Patch3: mutt-1.7.0-syncdebug.patch
 # FIXME make it to upstream
 Patch8: mutt-1.5.23-system_certs.patch
 Patch9: mutt-1.9.0-ssl_ciphers.patch
-Patch10: mutt-1.9.4-lynx_no_backscapes.patch
-Patch12: mutt-1.9.5-nodotlock.patch
-Patch13: mutt-1.12.1-optusegpgagent.patch
-Patch14: mutt-configure-c99.patch
+
+# CVE-2018-14354 CVE-2018-14357
+Patch10: mutt-1.9.2-quote_mbox_names.patch
+
+# CVE-2018-14362
+Patch11: mutt-1.9.2-sanitize_pop_paths.patch
+
+# CVE-2018-14355
+Patch12: mutt-1.9.2-selectively_cache_headers.patch
+
+# CVE-2018-14349
+Patch13: mutt-1.9.2-Handle_NO_response_without_message_properly.patch
+
+# CVE-2018-14350 CVE-2018-14358
+Patch14: mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch
+
+# CVE-2018-14351
+Patch15: mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch
+
+# CVE-2018-14352 CVE-2018-14353
+Patch16: mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch
+
+# CVE-2018-14356
+Patch17: mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch
+
+# CVE-2018-14359
+Patch18: mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch

 Url: http://www.mutt.org
 Requires: mailcap, urlview
-BuildRequires: make
-BuildRequires: gcc
 BuildRequires: ncurses-devel, gettext, automake
 # manual generation
 BuildRequires: /usr/bin/xsltproc, docbook-style-xsl, perl-interpreter
 BuildRequires: perl-generators
-BuildRequires: lynx
+# html manual -> txt manual conversion (lynx messes up the encoding)
+BuildRequires: w3m

 %if %{with hcache}
 %{?with_tokyocabinet:BuildRequires: tokyocabinet-devel}
@ -67,7 +89,6 @@ BuildRequires: lynx
 %endif

 %{?with_idn:BuildRequires: libidn-devel}
-%{?with_idn2:BuildRequires: libidn2-devel}
 %{?with_gpgme:BuildRequires: gpgme-devel}


@ -82,21 +103,28 @@ for selecting groups of messages.
 %prep
 # unpack; cd
 %setup -q
+# disable mutt_dotlock program - disable post-install mutt_dotlock checking
+sed -i -r 's|install-exec-hook|my-useless-label|' Makefile.am
 # do not run ./prepare -V, because it also runs ./configure
-
-%patch -P10 -p1 -b .lynx_no_backscapes
-%patch -P12 -p1 -b .nodotlock
-%patch -P14 -p1
-
-autoreconf -fiv
-%patch -P1 -p1 -b .muttrc
-%patch -P2 -p1 -b .cabundle
-%patch -P3 -p1 -b .syncdebug
-%patch -P8 -p1 -b .system_certs
-%patch -P9 -p1 -b .ssl_ciphers
-%patch -P13 -p1 -b .optusegpgagent
+autoreconf --install
+%patch1 -p1 -b .muttrc
+%patch2 -p1 -b .cabundle
+%patch3 -p1 -b .syncdebug
+%patch8 -p1 -b .system_certs
+%patch9 -p1 -b .ssl_ciphers
+%patch10 -p1 -b .quote_mbox_names
+%patch11 -p1 -b .sanitize_pop_paths
+%patch12 -p1 -b .selectively_cache_headers
+%patch13 -p1 -b .Handle_NO_response_without_message_properly
+%patch14 -p1 -b .Don_t_overflow_tmp_in_msg_parse_fetch
+%patch15 -p1 -b .Verify_IMAP_status_mailbox_literal_count_size
+%patch16 -p1 -b .Fix_imap_quote_string_length_check_errors
+%patch17 -p1 -b .Ensure_UID_in_fetch_uidl
+%patch18 -p1 -b .Check_outbuf_length_in_mutt_from_base64

 sed -i -r 's/`$GPGME_CONFIG --libs`/"\0 -lgpg-error"/' configure
+# disable mutt_dotlock program - remove support from mutt binary
+sed -i -r 's|^(.*USE_DOTLOCK.*)$|//\1|' configure

 install -p -m644 %{SOURCE1} mutt_ldap_query

@ -137,28 +165,19 @@ rm -f mutt_ssl.c
    %{?with_gss:	--with-gss} \
    %endif
 \
-    %{?with_idn:	--with-idn} \
    %{!?with_idn:	--without-idn} \
-    %{?with_idn2:   --with-idn2} \
-    %{!?with_idn2:  --without-idn2} \
-\
    %{?with_gpgme:	--enable-gpgme} \
    %{?with_sidebar: --enable-sidebar} \
    --with-docdir=%{_pkgdocdir}

-%make_build
+make %{?_smp_mflags}

 # remove unique id in manual.html because multilib conflicts
 sed -i -r 's/<a id="id[a-z0-9]\+">/<a id="id">/g' doc/manual.html

-# fix the shebang in mutt_oauth2.py & preserve the time stamp
-oauth2_script="contrib/mutt_oauth2.py"
-t=$(stat -c %y "${oauth2_script}")
-sed -i "s:^#\!/usr/bin/env\s\+python3\s\?$:#!%{python3}:" "${oauth2_script}"
-touch -d "$t" "${oauth2_script}"

 %install
-%make_install
+make install DESTDIR=%{buildroot}

 # we like GPG here
 cat contrib/gpg.rc >> \
@ -188,9 +207,6 @@ rm -f %{buildroot}%{_mandir}/man5/mbox.5*
 rm -f %{buildroot}%{_mandir}/man5/mmdf.5*
 rm -rf %{buildroot}%{_pkgdocdir}

-# remove /usr/share/info/dir
-rm -f %{buildroot}%{_infodir}/dir
-
 # provide muttrc.local(5): the same as muttrc(5)
 ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5

@ -201,286 +217,31 @@ ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5
 %{!?_licensedir:%global license %doc}
 %license COPYRIGHT GPL
 %doc ChangeLog NEWS README* UPDATING mutt_ldap_query
-%doc contrib/mutt_oauth2.py contrib/mutt_oauth2.py.README
 %doc contrib/*.rc contrib/sample.* contrib/colors.*
 %doc doc/manual.html doc/manual.txt doc/smime-notes.txt
 %config(noreplace) %{_sysconfdir}/Muttrc
 %config(noreplace) %{_sysconfdir}/Muttrc.local
 %{_bindir}/mutt
-%{_bindir}/mutt_pgpring
+%{_bindir}/pgpring
 %{_bindir}/pgpewrap
 %{_bindir}/smime_keys
 %{_mandir}/man1/mutt.*
 %{_mandir}/man1/smime_keys.*
-%{_mandir}/man1/mutt_pgpring.*
+%{_mandir}/man1/pgpring.*
 %{_mandir}/man1/pgpewrap.*
 %{_mandir}/man5/muttrc.*
-%{_infodir}/mutt.info.*


 %changelog
-* Thu Jan 08 2026 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.16-2
- rebuild
-
-* Sat Dec 27 2025 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.16-1
- updated to 2.2.16 (#2416539)
-
-* Thu Nov 20 2025 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.15-2
- rebuilt for new gpgme
-
-* Mon Nov 03 2025 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.15-1
- updated to 2.2.15 (#2400970)
-
-* Fri Aug 01 2025 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.14-4
- fix FTBFS (rhbz#2385201)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.14-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jul 22 2025 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.14-2
- adjust to Dropping of cert.pem file system change
-
-* Mon Feb 24 2025 Michal Hlavinka <mhlavink@redhat.com> - 5:2.2.14-1
- updated to 2.2.14 (#2346767)
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.13-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.13-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Sat Jun 22 2024 Ondrej Sloup <osloup@redhat.com> -  5:2.2.13-2
- Remove docbookX2 BuildRequire dependency as it is being deprecated
-
-* Wed Mar 20 2024 Matej Mužila <mmuzila@redhat.com> - 5:2.2.13-1
- Upgrade to 2.2.13
- Resolves: #2268671
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.12-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.12-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Dec  7 2023 Florian Weimer <fweimer@redhat.com> - 5:2.2.12-2
- Fix C99 compatibility issue
-
-* Mon Nov 13 2023 Matej Mužila <mmuzila@redhat.com> - 5:2.2.12-1
- Upgrade to 2.2.12
- Resolves: #2232712
-
-* Tue Sep 05 2023 Matej Mužila <mmuzila@redhat.com> - 5:2.2.11-1
- Upgrade to 2.2.11
- Resolves: #2232712
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.10-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Mon Apr 17 2023 Matej Mužila <mmuzila@redhat.com> - 5:2.2.10-1
- Upgrade to 2.2.10
- Resolves: #2181780
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Wed Nov 23 2022  Matej Mužila <mmuzila@redhat.com> - 5:2.2.9-1
- Upgrade to 2.2.9
- Resolves: 2140353
-
-* Thu Aug 11 2022  Matej Mužila <mmuzila@redhat.com> - 5:2.2.7-1
- Upgrade to 2.2.7
- Resolves: 2116172
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.2.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Wed Jun 15 2022  Matej Mužila <mmuzila@redhat.com> - 5:2.2.6-1
- Upgrade to 2.2.6
- Resolves: 2093746
-
-* Mon May 30 2022  Matej Mužila <mmuzila@redhat.com> - 5:2.2.5-1
- Upgrade to 2.2.5
- Resolves: 2068653
-
-* Thu Apr 21 2022 Matej Mužila <mmuzila@redhat.com> - 5:2.2.3-1
- Upgrade to 2.2.3
-  Resolves: CVE-2022-1328
-
-* Mon Mar 28 2022 Matej Mužila <mmuzila@redhat.com> - 5:2.2.2-1
- Upgrade to 2.2.2
-  Resolves: #2068653
-
-* Tue Feb 22 2022 Matej Mužila <mmuzila@redhat.com> - 5:2.2.1-1
- Upgrade to 2.2.1
-  Resolves: #2053874
-
-* Wed Feb 16 2022 Matej Mužila <mmuzila@redhat.com> - 5:2.2.0-1
- Upgrade to 2.2.0
-  Resolves: #2053874
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.1.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Jan 03 2022 Matej Mužila <mmuzila@redhat.com> - 5:2.1.5-1
- Upgrade to 2.1.5
-
-* Mon Oct 25 2021 Matej Mužila <mmuzila@redhat.com> - 5:2.1.3-1
- Upgrade to 2.1.3
-
-* Tue Aug 10 2021 Matej Mužila <mmuzila@redhat.com> - 5:2.1.1-1
- Upgrade to 2.1.1
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.0.7-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Fri May  7 2021 Dan Čermák <dan.cermak@cgc-instruments.com> - 5:2.0.7-2
- Ship the mutt_oauth2.py script as well
-
-* Thu May 6 2021 Filip Januš <fjanus@redhat.com> 5:2.0.7-1
-Rebase to v2.0.7
-
-* Mon Mar 22 2021 Filip Januš <fjanus@redhat.com> 5:2.0.6-1
- Rebase to upstream version 2.0.6
-
-* Mon Feb 1 2021 Filip Januš <fjanus@redhat.com> -5:2.0.5-1
- Rebase to upstream version 2.0.5
- Fix CVE-2021-3181
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5:2.0.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Tue Dec 01 2020 Matej Mužila <mmuzila@redhat.com> - 5:2.0.2-1
- Upgrade to 2.0.2
- Resolves: #1895629, #1900827, CVE-2020-28896
-
-* Tue Sep 01 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.14.7-2
- Fix mutt-1.9.4-lynx_no_backscapes.patch
-
-* Mon Aug 31 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.14.7-1
- Upgrade to 1.14.7
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5:1.14.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 22 2020 Fabio Alessandro Locati <fale@fedoraproject.org> - 5:1.14.6-1
- Upgrade to 1.14.6
-
-* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 5:1.14.5-2
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Wed Jun 24 2020 Fabio Alessandro Locati <fale@fedoraproject.org> - 5:1.14.5-1
- Upgrade to 1.14.5
-
-* Fri Jun 19 2020 Fabio Alessandro Locati <fale@fedoraproject.org> - 5:1.14.4-1
- Upgrade to 1.14.4
- Resolves: #1848768
-
-* Mon Jun 15 2020 Fabio Alessandro Locati <fale@fedoraproject.org> - 5:1.14.3-1
- Upgrade to 1.14.3
- Resolves: #1836550
-
-* Tue May 26 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.14.2-1
- Upgrade to 1.14.2
- Resolves: #1836550
-
-* Sat May 09 2020 Fabio Alessandro Locati <fale@fedoraproject.org> - 5:1.14.0-1
- Upgrade to 1.14.0
- Resolves: #1818513
-
-* Tue Apr 07 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.13.5-1
- Upgrade to 1.13.5
- Resolves: #1818513
-
-* Mon Feb 17 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.13.4-1
- Upgrade to 1.13.4
- Resolves: #1803392
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5:1.13.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Wed Jan 15 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.13.3-1
- Upgrade to 1.13.3
- Resolves: #1783717, #1785500
-
-* Fri Jan 03 2020 Matej Mužila <mmuzila@redhat.com> - 5:1.13.2-1
- Upgrade to 1.13.2
- Resolves: #1783717
-
-* Mon Dec 02 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.13.0-1
- Upgrade to 1.13.0
- Resolves: #1754211
-
-* Tue Sep 24 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.12.2-1
- Upgrade to 1.12.2
- Resolves: #1754211
-
-* Thu Aug 29 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.12.1-3
- Make mutt to ask for GPG passphrase
- Resolves: #1731854
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 5:1.12.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Wed Jul 17 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.12.1-1
- Upgrade to 1.12.1
- Resolves #1720848
-
-* Tue May 28 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.12.0-1
- Upgrade to 1.12.0
- Resolves #1710398,#1713910
-
-* Wed Apr 24 2019 Björn Esser <besser82@fedoraproject.org> - 5:1.11.4-2
- Remove hardcoded gzip suffix from GNU info pages
-
-* Wed Feb 06 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.11.4-1
- Upgrade to 1.11.4
- Resolves #1688091
-
-* Wed Feb 06 2019 Matej Mužila <mmuzila@redhat.com> - 5:1.11.3-1
- Upgrade to 1.11.3
- Resolves #1659217
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 5:1.10.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Tue Jul 17 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.10.1-1
- Upgrade to 1.10.1
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 5:1.10.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu May 24 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.10.0-2
- Disable post-install mutt_dotlock checking by patch, not by sed.
-
-* Tue May 22 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.10.0-1
- Upgrade to 1.10.0
-
-* Thu Apr 19 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.5-4
- Disable dotlock by patch instead of sed
- Resolves: #1568597
-
-* Wed Apr 18 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.5-3
- Apply patches of autoreconf related configuration files before running
-  autoreconf
-
-* Mon Apr 16 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.5-2
- Use libidn2 instead of libidn
-
-* Mon Apr 16 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.5-1
- Upgrade to 1.9.5
-
-* Fri Apr 13 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.4-2
- Use lynx to generate documentation
-
-* Mon Apr 09 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.4-1
- Upgrade to 1.9.4
-
-* Tue Feb 13 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.3-1
- Upgrade to 1.9.3
-
-* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 5:1.9.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+* Thu Jul 19 2018 Matej Mužila <mmuzila@redhat.com> - 5:1.9.2-2
+- Backport security patches from mutt-1.10.1
+- Resolves: #1602082 (CVE-2018-14354, CVE-2018-14355, CVE-2018-14362)
+- Resolves: #1602916 (CVE-2018-14357)
+- Resolves: #1602923 (CVE-2018-14350)
+- Resolves: #1602935 (CVE-2018-14349)
+- Resolves: #1602954 (CVE-2018-14351)
+- Resolves: CVE-2018-14358, CVE-2018-14352, CVE-2018-14353, CVE-2018-14356,
+  CVE-2018-14359

 * Wed Dec 20 2017 Matej Mužila <mmuzila@redhat.com> - 5:1.9.2-1
 - Upgrade to 1.9.2
@ -539,7 +300,7 @@ ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

 * Fri Sep 04 2015 Matej Muzila <mmuzila@redhat.com> - 5:1.5.24-1
- Updated to 1.5.24 (Resolves: rhbz#1259332)
+- Updated to 1.5.24 (Resolves: rhbz#1259332)
 - Utilize system-wide crypto-policies (Resolves: rhbz#1179324)

 * Thu Jun 25 2015 Matej Muzila <mmuzila@redhat.com> - 5:1.5.23-9
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (mutt-2.2.16.tar.gz) = 5048aa9af6d928be59fe42b0bdbf22fc46c1dd47582cc7036782bff5756af2410ba80f2398c1edbf7be59a96eaa6736c8b8eff198f0dfc8841fb744093a39f80
+SHA512 (mutt-1.9.2.tar.gz) = 3e35f3d27f1444bcee38e98fe62d41c7fa5b56ac9d5010b1c2cbf034c1e707491a09ccc7387b8d90d8c6c7150edf1d9093fec981d348cf9495313859d373b339
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -1,9 +0,0 @@
- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    tests:
-    - simple:
-        dir: .
-        run: mutt --help