CVE:CVE-2012-1103
CNNVD:CNNVD-201205-468
Notmuch 0.11.1之前版本中的emacs/notmuch-mua.el中存在漏洞。由于所使用的Emacs接口没有正确地引用邮件回复CNA中的MML标签，任意文件都可以在错误的引用下成为所发送邮件的附件。通过诱使用户回复带有特制MML标签的邮件，远程攻击者可成功利用该漏洞读取任意文件。
solution:Upgrade notmuchmail notmuch to a higher version than 0.11,0.1,0.1.1,0.2,0.3,0.3.1,0.4,0.5,0.6,0.6:254,0.6:rc1,0.6.1,0.7,0.7:rc1,0.8,0.8:rc0,0.8:rc1,0.9,0.9:rc1,0.9:rc2,0.10,0.10:rc1,0.10:rc2,0.10.1,0.10.2,0.11:rc1,0.11:rc2,0.11:rc2-1,0.11:rc3,0.11:rc3-1,and avoid the version (,0.11],0.1,0.1.1,0.2,0.3,0.3.1,0.4,0.5,0.6,0.6:254,0.6:rc1,0.6.1,0.7,0.7:rc1,0.8,0.8:rc0,0.8:rc1,0.9,0.9:rc1,0.9:rc2,0.10,0.10:rc1,0.10:rc2,0.10.1,0.10.2,0.11:rc1,0.11:rc2,0.11:rc2-1,0.11:rc3,0.11:rc3-1