Vulnerability

    exmh

Affected

    exmh 2.2 and probably previous versions

Description

    Stanley G. Bubrouski found following.  When exmh detects a problem
    at  startup  (or  possibly  other  times,  Stan didn't had time to
    investigate) it encounters errors in its code or configuration  an
    error dialog  comes up  asking the  user what  happened and giving
    them the option to  fill in an explanation  and click a button  to
    send the bug  report via e-mail  to the maintainer.   If the  user
    does   attempt   to   e-mail   the   maintainer   a   file   named
    /tmp/exmhErrorMsg  is  created  and  if  the  file exists and is a
    symlink it  will follow  the symlink  allowing local  files to  be
    overwritten depending on the user running exmh.

Solution

    Note  that  any  user  can  protect  themselves without applying a
    patch.   Exmh already  has a  feature that  allows users to choose
    their own tmp directory  via the TMPDIR or  EXMHTMPDIR environment
    variable.   However, a  patch that  causes exmh  to pick  a better
    directory by default is in place and available from the above  web
    page.  The change is also checked into CVS.

    Fix is available on:

        http://www.beedub.com/exmh/symlink.html

    For Debian Linux:

        http://security.debian.org/dists/stable/updates/main/source/exmh_2.1.1-1.1.diff.gz
        http://security.debian.org/dists/stable/updates/main/source/exmh_2.1.1-1.1.dsc
        http://security.debian.org/dists/stable/updates/main/source/exmh_2.1.1.orig.tar.gz
        http://security.debian.org/dists/stable/updates/main/binary-all/exmh_2.1.1-1.1_all.deb

    For Linux-Mandrake:

        Linux-Mandrake 6.0: 6.0/RPMS/exmh-2.0.2-8.1mdk.noarch.rpm
                            6.0/SRPMS/exmh-2.0.2-8.1mdk.src.rpm
        Linux-Mandrake 6.1: 6.1/RPMS/exmh-2.0.3-8.1mdk.noarch.rpm
                            6.1/SRPMS/exmh-2.0.3-8.1mdk.src.rpm
        Linux-Mandrake 7.0: 7.0/RPMS/exmh-2.1.1-5.1mdk.noarch.rpm
                            7.0/SRPMS/exmh-2.1.1-5.1mdk.src.rpm
        Linux-Mandrake 7.1: 7.1/RPMS/exmh-2.1.1-5.1mdk.noarch.rpm
                            7.1/SRPMS/exmh-2.1.1-5.1mdk.src.rpm
        Linux-Mandrake 7.2: 7.2/RPMS/exmh-2.2-4.1mdk.noarch.rpm
                            7.2/SRPMS/exmh-2.2-4.1mdk.src.rpm
    Corporate Server 1.0.1: 1.0.1/RPMS/exmh-2.1.1-5.1mdk.noarch.rpm
                            1.0.1/SRPMS/exmh-2.1.1-5.1mdk.src.rpm

    For FreeBSD:

        ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/mail/exmh-2.3.1.tgz
        ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/mail/exmh-2.3.1.tgz
        ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/mail/exmh-2.3.1.tgz