CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2005-1151 – Debian Linux Security Advisory 728-1
https://notcve.org/view.php?id=CVE-2005-1151
25 May 2005 — qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root. Jens Steube discovered that Qpopper doesn't drop privileges to process local files from normal users (CVE-2005-1151). The upstream developers discovered that Qpopper can be forced to create group or world writeable files (CVE-2005-1152). Versions less than 4.0.5-r3 are affected. • http://bugs.gentoo.org/show_bug.cgi?id=90622 •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2005-1152 – Debian Linux Security Advisory 728-1
https://notcve.org/view.php?id=CVE-2005-1152
25 May 2005 — popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions. Jens Steube discovered that Qpopper doesn't drop privileges to process local files from normal users (CVE-2005-1151). The upstream developers discovered that Qpopper can be forced to create group or world writeable files (CVE-2005-1152). Versions less than 4.0.5-r3 are affected. • http://bugs.gentoo.org/attachment.cgi?id=58329&action=view •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 4CVE-2003-1452 – Qpopper 4.0.x - 'poppassd' Privilege Escalation
https://notcve.org/view.php?id=CVE-2003-1452
31 Dec 2003 — Untrusted search path vulnerability in Qualcomm qpopper 4.0 through 4.05 allows local users to execute arbitrary code by modifying the PATH environment variable to reference a malicious smbpasswd program. • https://www.exploit-db.com/exploits/21 • CWE-16: Configuration •