CVE-2005-1151: qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published May 25, 2005

CVE-2005-1151

qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root

–

CVSS

0.4%

EPSS

No

On KEV

Description

qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 29% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

QP

Qpopper · Debian

through 4.0.4; 4.0.5 · source: NVD

Affected product

QP

Qpopper

Debian

All Qpopper CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2005-1151

https://www.cve.org/CVERecord?id=CVE-2005-1151

bugs.gentoo.org

http://bugs.gentoo.org/show_bug.cgi?id=90622

http://secunia.com/advisories/15475

http://secunia.com/advisories/15478

http://secunia.com/advisories/15505

http://www.debian.org/security/2005/dsa-728

http://www.gentoo.org/security/en/glsa/glsa-200505-17.xml

More from Qpopper

–

popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions