Description
masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-848-1 masqmail - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2005:168 vendor-advisory
- masqmail-log-file-symlink(22347) vdb-entry
- ADV-2005-1807 vdb-entry
- 16883 third-party-advisory
- 17109 third-party-advisory
- 19584 vdb-entry
- 14890 vdb-entry
- DSA-848 vendor-advisory