Description
Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mutt | 1.5.13-1.1 | — |
| Debian 13 | mutt | 1.5.13-1.1 | — |
| Debian 12 | mutt | 1.5.13-1.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mutt | 5:1.4.2.2-3.0.2.el5 | RHSA-2007:0386 |
| RHEL 4 | mutt | 5:1.4.1-12.0.3.el4 | RHSA-2007:0386 |
| RHEL 3 | mutt | 5:1.4.1-5.el3 | RHSA-2007:0386 |
Advisories 1
- RHSA-2007:0386 Red Hat Security Advisory: mutt security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 25529 third-party-advisory
- [mutt-dev] 20061004 security problem with temp files [was Re: mutt_adv_mktemp() ?] mailing-list
- 20733 vdb-entry
- oval:org.mitre.oval:def:10601 vdb-entry signature
- 2006-0061 vendor-advisory
- 22640 third-party-advisory
- 22613 third-party-advisory
- 22685 third-party-advisory
- 22686 third-party-advisory
- USN-373-1 vendor-advisory
- RHSA-2007:0386 vendor-advisory
- ADV-2006-4176 vdb-entry
- MDKSA-2006:190 vendor-advisory