Description
qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | qpopper | 4.0.4-2.woody.5 | DSA-728-1 |
Advisories 1
- DSA-728-1 qpopper - missing privilege release Debian Security (DSA / DLA) · Mar 9, 2026
References
- 15505 third-party-advisory
- 15478 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=90622
- DSA-728 vendor-advisory
- 15475 third-party-advisory
- GLSA-200505-17 vendor-advisory