CVE-2006-5298

2006-10-1619:07:00

Debian Security Bug Tracker

security-tracker.debian.org

1.2 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.

OSVersionArchitecturePackageVersionFilename
Debian12allmutt< 1.5.13-1.1mutt_1.5.13-1.1_all.deb
Debian11allmutt< 1.5.13-1.1mutt_1.5.13-1.1_all.deb
Debian10allmutt< 1.5.13-1.1mutt_1.5.13-1.1_all.deb
Debian999allmutt< 1.5.13-1.1mutt_1.5.13-1.1_all.deb
Debian13allmutt< 1.5.13-1.1mutt_1.5.13-1.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mutt	< 1.5.13-1.1	mutt_1.5.13-1.1_all.deb
Debian	11	all	mutt	< 1.5.13-1.1	mutt_1.5.13-1.1_all.deb
Debian	10	all	mutt	< 1.5.13-1.1	mutt_1.5.13-1.1_all.deb
Debian	999	all	mutt	< 1.5.13-1.1	mutt_1.5.13-1.1_all.deb
Debian	13	all	mutt	< 1.5.13-1.1	mutt_1.5.13-1.1_all.deb