CVE-2005-1152: popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published May 25, 2005

CVE-2005-1152

popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions

–

CVSS

0.4%

EPSS

No

On KEV

Description

popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 30% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

QP

Qpopper · Debian

through 4.0.4; 4.0.5 · source: NVD

Affected product

QP

Qpopper

Debian

All Qpopper CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2005-1152

https://www.cve.org/CVERecord?id=CVE-2005-1152

bugs.gentoo.org

http://bugs.gentoo.org/attachment.cgi?id=58329&action=view

bugs.gentoo.org

http://bugs.gentoo.org/show_bug.cgi?id=90622

http://secunia.com/advisories/15475

http://secunia.com/advisories/15478

http://secunia.com/advisories/15505

http://www.debian.org/security/2005/dsa-728

More from Qpopper

–

qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root