XMail creates temporary files in an insecure manner. An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible. Versions prior to XMail 1.27 are affected.

Updates are available. Please see the references for details.

• http://www.securityfocus.com/bid/38427
• http://www.xmailserver.org/
• http://www.xmailserver.org/ChangeLog.html#feb_25__2010_v_1_27

---

Updated on 2015-03-25