PT-2006-6020 · Mutt+1 · Mutt+1

Derek Martin · Published 2006-10-16 · Updated 2016-10-18 · CVE-2006-5298

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mutt versions 1.5.12 and earlier

Description The issue arises from the mutt adv mktemp function in the Mutt mail client, which fails to properly verify that temporary files have been created with restricted permissions. This could allow local users to create files with weak permissions via a race condition between the mktemp and safe fopen function calls.

Recommendations For versions 1.5.12 and earlier, update to a version that addresses this issue, as the current version does not properly restrict permissions for temporary files.

Fix

Related Identifiers

ALT-PU-2015-1458

CVE-2006-5298

Affected Products

Alt Linux

Mutt

References · 21

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1268 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-5298 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2351 · Security Note
• http://trustix.org/errata/2006/0061 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-5298 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5298 · Vendor Advisory
• http://ubuntu.com/usn/usn-373-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:190 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-5298 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1458 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5298 · Security Note
• https://bdu.fstec.ru/vul/2015-01338 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5297 · Security Note
• http://secunia.com/advisories/22686 · Note