Description
The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mutt | 1.5.13-1.1 | — |
| Debian 13 | mutt | 1.5.13-1.1 | — |
| Debian 12 | mutt | 1.5.13-1.1 | — |
References
- [mutt-dev] 20061004 security problem with temp files [was Re: mutt_adv_mktemp() ?] mailing-list
- 2006-0061 vendor-advisory
- 22640 third-party-advisory
- 22613 third-party-advisory
- 22685 third-party-advisory
- 22686 third-party-advisory
- USN-373-1 vendor-advisory
- MDKSA-2006:190 vendor-advisory