UnratedFix available
mutt — security advisory
Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
- Products
- mutt
- Affected versions
- Not specified
- Fixed versions
- 1.5.13-1.1
- CVEs
- CVE-2006-5297
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:12 UTC · Revision 1
Source evidence
Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
osv:DEBIAN-CVE-2006-5297
mutt
Fixed versions: 1.5.13-1.1
mutt
Fixed versions: 1.5.13-1.1
mutt
Fixed versions: 1.5.13-1.1
Complete source record
{
"id": "557273c571087238d6b0ceb0c7c304c0a09e1ff8022a2d44188f580a5aa27921",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-5297",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-5297",
"summary": "Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.",
"evidence": "osv:DEBIAN-CVE-2006-5297",
"products": [
{
"name": {
"value": "mutt",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.13-1.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mutt",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.13-1.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mutt",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.13-1.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-5297",
"aliases": [
"DEBIAN-CVE-2006-5297"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13-1.1"
}
]
}
],
"package": {
"name": "mutt",
"purl": "pkg:deb/debian/mutt?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-5297.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13-1.1"
}
]
}
],
"package": {
"name": "mutt",
"purl": "pkg:deb/debian/mutt?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-5297.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13-1.1"
}
]
}
],
"package": {
"name": "mutt",
"purl": "pkg:deb/debian/mutt?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-5297.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-22T23:47:23.972770959Z",
"provider": "osv",
"upstream": [
"CVE-2006-5297"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-5297"
]
},
"related_cves": [
{
"value": "CVE-2006-5297",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410425,
"published_at": "2006-10-16T19:07:00+00:00"
}