Skip to content
OpenAdvisories
Unscored CVE-2005-2655 EUVD-2005-2656GHSA-mjj8-2wvx-jfh5

lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via comma…

Published Aug 30, 2005 · Updated Sep 17, 2024 · Assigned by debian

Package: maildrop Ecosystem: Debian

Description

lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 maildrop 2.0.2-7 —
Debian 13 maildrop 2.0.2-7 —
Debian 12 maildrop 2.0.2-7 —
Debian 4.0 maildrop 1.5.3-1.1etch1 DTSA-11-1
Debian 3.1 maildrop 1.5.3-1.1sarge1 DSA-791-1

Advisories 2

References