Version in base suite: 2.2.13-1+deb13u1

Base version: mutt_2.2.13-1+deb13u1
Target version: mutt_2.2.13-1+deb13u2
Base file: /srv/ftp-master.debian.org/ftp/pool/main/m/mutt/mutt_2.2.13-1+deb13u1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/m/mutt/mutt_2.2.13-1+deb13u2.dsc

 changelog                     |    6 ++++++
 patches/CVE-2026-107570.patch |   21 +++++++++++++++++++++
 patches/series                |    1 +
 3 files changed, 28 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpmzgp586p/mutt_2.2.13-1+deb13u1.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpmzgp586p/mutt_2.2.13-1+deb13u2.dsc: no acceptable signature found
diff -Nru mutt-2.2.13/debian/changelog mutt-2.2.13/debian/changelog
--- mutt-2.2.13/debian/changelog	2026-06-11 21:05:00.000000000 +0000
+++ mutt-2.2.13/debian/changelog	2026-10-09 18:03:14.000000000 +0000
@@ -1,3 +1,9 @@
+mutt (2.2.13-1+deb13u2) trixie-security; urgency=medium
+
+  * CVE-2026-107570 (Closes: #1150407)
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Fri, 09 Oct 2026 20:03:14 +0200
+
 mutt (2.2.13-1+deb13u1) trixie; urgency=medium
 
   * CVE-2026-43859 CVE-2026-43860 CVE-2026-43861 CVE-2026-43862
diff -Nru mutt-2.2.13/debian/patches/CVE-2026-107570.patch mutt-2.2.13/debian/patches/CVE-2026-107570.patch
--- mutt-2.2.13/debian/patches/CVE-2026-107570.patch	1970-01-01 00:00:00.000000000 +0000
+++ mutt-2.2.13/debian/patches/CVE-2026-107570.patch	2026-10-09 18:03:11.000000000 +0000
@@ -0,0 +1,21 @@
+From 7752d93f26f8f1384905fad874afff5abb0f3e54 Mon Sep 17 00:00:00 2001
+From: "Kevin J. McCarthy" <kevin@8t8.us>
+Date: Tue, 6 Oct 2026 13:50:42 +0800
+Subject: [PATCH] Fix OOB heap write in convert_file_from_to().
+
+--- mutt-2.2.13.orig/sendlib.c
++++ mutt-2.2.13/sendlib.c
+@@ -842,11 +842,11 @@ static size_t convert_file_from_to (FILE
+ 
+   /* Copy them */
+   tcode = safe_malloc (ncodes * sizeof (char *));
+-  for (c = tocodes, i = 0; c; c = c1 ? c1 + 1 : 0, i++)
++  for (c = tocodes, i = 0; c; c = c1 ? c1 + 1 : 0)
+   {
+     if ((c1 = strchr (c, ':')) == c)
+       continue;
+-    tcode[i] = mutt_substrdup (c, c1);
++    tcode[i++] = mutt_substrdup(c, c1);
+   }
+ 
+   ret = (size_t)(-1);
diff -Nru mutt-2.2.13/debian/patches/series mutt-2.2.13/debian/patches/series
--- mutt-2.2.13/debian/patches/series	2026-06-11 13:14:44.000000000 +0000
+++ mutt-2.2.13/debian/patches/series	2026-10-09 18:02:52.000000000 +0000
@@ -16,3 +16,4 @@
 CVE-2026-43862.patch
 CVE-2026-43863.patch
 CVE-2026-43864.patch
+CVE-2026-107570.patch