UnratedFix available
mutt — security advisory
The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.
- Products
- mutt
- Affected versions
- Not specified
- Fixed versions
- 1.5.13-1.1
- CVEs
- CVE-2006-5298
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:10 UTC · Revision 1
Source evidence
The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.
osv:DEBIAN-CVE-2006-5298
mutt
Fixed versions: 1.5.13-1.1
mutt
Fixed versions: 1.5.13-1.1
mutt
Fixed versions: 1.5.13-1.1
Complete source record
{
"id": "12aeb76960320756c6f948a5564c585fc8847322f51a440758a727727c85315c",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-5298",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-5298",
"summary": "The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.",
"evidence": "osv:DEBIAN-CVE-2006-5298",
"products": [
{
"name": {
"value": "mutt",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.13-1.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mutt",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.13-1.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mutt",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.13-1.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-5298",
"aliases": [
"DEBIAN-CVE-2006-5298"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13-1.1"
}
]
}
],
"package": {
"name": "mutt",
"purl": "pkg:deb/debian/mutt?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-5298.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13-1.1"
}
]
}
],
"package": {
"name": "mutt",
"purl": "pkg:deb/debian/mutt?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-5298.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13-1.1"
}
]
}
],
"package": {
"name": "mutt",
"purl": "pkg:deb/debian/mutt?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-5298.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-22T23:47:21.009412252Z",
"provider": "osv",
"upstream": [
"CVE-2006-5298"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-5298"
]
},
"related_cves": [
{
"value": "CVE-2006-5298",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410291,
"published_at": "2006-10-16T19:07:00+00:00"
}