Description
sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | claws-mail | 3.1.0-2 | — |
| Debian 13 | claws-mail | 3.1.0-2 | — |
| Debian 12 | claws-mail | 3.1.0-2 | — |
References
- 28402 third-party-advisory
- 42478 vdb-entry
- GLSA-200801-03 vendor-advisory
- 26676 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089
- 27897 third-party-advisory