mutt 2.2.3 released

--ymjcdJ5wZIapY6WF
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hello Mutt Users,

I've just released version 2.2.3.  Instructions for downloading are=20
available at <http://www.mutt.org/download.html>, or the tarball can be=20
directly downloaded from <http://ftp.mutt.org/pub/mutt/>.  Please take=20
the time to verify the signature file against my public key[1].

This is a bug-fix release, addressing CVE-2022-1328: a buffer overread=20
in the uuencoded decoder routine.  For more details please see GitLab=20
ticket 404: <https://gitlab.com/muttmua/mutt/-/issues/404>.  The commit=20
fixing this issue is at=20
<https://gitlab.com/muttmua/mutt/-/commit/e5ed080c00e59701ca62ef9b2a6d2612e=
bf765a5>

Also fixed were a possible integer overflow issue in the general iconv=20
and rfc2047-conversion iconv functions.  These are not believed to be=20
exploitable.

A huge thank you to Tavis Ormandy for reporting these issues, suggesting=20
a patch for the iconv issue, helping test, and providing constructive=20
feedback.  Hurray for the white-hats!

-Kevin

[1]
My public key is available at:
   - my personal website: https://www.8t8.us/configs/80316BDA.asc.pubkey
   - the mutt website: http://www.mutt.org/keys/kevin.key
   - The keys.openpgp.org network
     https://keys.openpgp.org/vks/v1/by-fingerprint/8975A9B33AA37910385C530=
8ADEF768480316BDA


--ymjcdJ5wZIapY6WF
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEiXWpszqjeRA4XFMIre92hIAxa9oFAmJV3isACgkQre92hIAx
a9pkfxAAqFFm8fUOROCDEkURsv266f52USnDh7SZ9Z7382rNQsgA7fFyRJYlZsV8
uSnHNGjYSdRMjt7HRH5oQCtV/JZyIbaC1itzRYwAGKZTkSTfzS2W0MxKzXTukWjj
H+iHk1MDrRYjSB2r0Pj8rlbPIQZXrB9+jTOtYgYrfwfuWtDSjEep/ITjqzK4GFLU
lkPjpfWxmFlEOEPkpbwYKRKj5IVuDzozz/a08s2MgPQdQo3uqmz/yXn5mZa0gKew
UGs28YBiHitlZuki8eHvr2zNRevPOFKZZf+8dP7hRcnr9TedvJIZaMEz6mkm9BrR
Ws5fGEKA24Jww++XEAATFhAyzdUEW66JkZSrciprcrimcAiTKkxT8cHRupdpPDFf
oR2l2gW57/rqy0KWveb/9EoV+QhJKaZhvHMrVfKijuSYizNx/XWiAJiKG/SQAf8l
0PmHszDP3mB50C77eYhxwwaoRepJ/Y4LQHbIXC/zyL55Q9XYGldnAsXgAorOwxha
sbXzmsXkPeYIk5zbiwRKzYkisVMc8Kg3IFfqzPkiMWhRf7vTTsKw0oBq0X1nAE3I
ldpvP0a5eFIiCSlBhuubpTe1ui2fcdmG6OPAc8MCkBxxb2HXq1jRwCA6gSXVa/bh
mB0yCWM3qLFrs0TQVo5f9Vxkgb5JK9Sa2y89l7Jp+xWvg0PHMXE=
=ulgz
-----END PGP SIGNATURE-----

--ymjcdJ5wZIapY6WF--