CVE-2006-5298 Race condition in n/a

Low 1.2 Published 16 Oct 2006 Updated 7 Aug 2024

Local attackers can exploit a race condition in Mutt to create temporary files with weak permissions, potentially leading to privilege escalation or data modification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2006-5298?

CVE-2006-5298 is a low-severity vulnerability in n/a, published on 16 Oct 2006. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.

Which versions are affected by CVE-2006-5298?

It affects 1 product.

Products include Mutt Mutt.

How do I fix CVE-2006-5298?

Upgrade to a fixed version.

Is CVE-2006-5298 being exploited?

There is no known exploitation of CVE-2006-5298 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2006-5298, GHSA-c2x8-j25c-mhfm.