Read the docs
TI-2005-02527 Aliases CVE-2005-2663GHSA-22g9-8497-wf8p

masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.

Priority LOW 11Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.

Why it matters now

EPSS 0.00362 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:masqmail:masqmail:0.0.0:*:*:*:*:*:*:*0.0.0Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.1:*:*:*:*:*:*:*0.0.1Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.2:*:*:*:*:*:*:*0.0.2Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.3:*:*:*:*:*:*:*0.0.3Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.4:*:*:*:*:*:*:*0.0.4Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.6:*:*:*:*:*:*:*0.0.6Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.7:*:*:*:*:*:*:*0.0.7Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.8:*:*:*:*:*:*:*0.0.8Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.9:*:*:*:*:*:*:*0.0.9Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.10:*:*:*:*:*:*:*0.0.10Vulnerablemasqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.0:*:*:*:*:*:*:* Versions 0.0.0 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.1:*:*:*:*:*:*:* Versions 0.0.1 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.2:*:*:*:*:*:*:* Versions 0.0.2 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.3:*:*:*:*:*:*:* Versions 0.0.3 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.4:*:*:*:*:*:*:* Versions 0.0.4 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.6:*:*:*:*:*:*:* Versions 0.0.6 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.7:*:*:*:*:*:*:* Versions 0.0.7 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.8:*:*:*:*:*:*:* Versions 0.0.8 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.9:*:*:*:*:*:*:* Versions 0.0.9 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.10:*:*:*:*:*:*:* Versions 0.0.10 Vulnerable ·masqmail
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:masqmail:masqmail:0.0.11:*:*:*:*:*:*:*0.0.11Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.0.13:*:*:*:*:*:*:*0.0.13Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.0:*:*:*:*:*:*:*0.1.0Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.1:*:*:*:*:*:*:*0.1.1Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.2:*:*:*:*:*:*:*0.1.2Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.3:*:*:*:*:*:*:*0.1.3Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.4:*:*:*:*:*:*:*0.1.4Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.5:*:*:*:*:*:*:*0.1.5Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.6:*:*:*:*:*:*:*0.1.6Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.7:*:*:*:*:*:*:*0.1.7Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.8:*:*:*:*:*:*:*0.1.8Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.9:*:*:*:*:*:*:*0.1.9Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.10:*:*:*:*:*:*:*0.1.10Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.11:*:*:*:*:*:*:*0.1.11Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.1.12:*:*:*:*:*:*:*0.1.12Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.0:*:*:*:*:*:*:*0.2.0Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.1:*:*:*:*:*:*:*0.2.1Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.2:*:*:*:*:*:*:*0.2.2Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.3:*:*:*:*:*:*:*0.2.3Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.4:*:*:*:*:*:*:*0.2.4Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.5:*:*:*:*:*:*:*0.2.5Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.6:*:*:*:*:*:*:*0.2.6Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.7:*:*:*:*:*:*:*0.2.7Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.8:*:*:*:*:*:*:*0.2.8Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.9:*:*:*:*:*:*:*0.2.9Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.10:*:*:*:*:*:*:*0.2.10Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.11:*:*:*:*:*:*:*0.2.11Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.12:*:*:*:*:*:*:*0.2.12Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.13:*:*:*:*:*:*:*0.2.13Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.14:*:*:*:*:*:*:*0.2.14Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.15:*:*:*:*:*:*:*0.2.15Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.16:*:*:*:*:*:*:*0.2.16Vulnerablemasqmail
cpe:2.3:a:masqmail:masqmail:0.2.17:*:*:*:*:*:*:*0.2.17Vulnerablemasqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.11:*:*:*:*:*:*:* Versions 0.0.11 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.0.13:*:*:*:*:*:*:* Versions 0.0.13 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.0:*:*:*:*:*:*:* Versions 0.1.0 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.1:*:*:*:*:*:*:* Versions 0.1.1 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.2:*:*:*:*:*:*:* Versions 0.1.2 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.3:*:*:*:*:*:*:* Versions 0.1.3 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.4:*:*:*:*:*:*:* Versions 0.1.4 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.5:*:*:*:*:*:*:* Versions 0.1.5 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.6:*:*:*:*:*:*:* Versions 0.1.6 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.7:*:*:*:*:*:*:* Versions 0.1.7 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.8:*:*:*:*:*:*:* Versions 0.1.8 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.9:*:*:*:*:*:*:* Versions 0.1.9 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.10:*:*:*:*:*:*:* Versions 0.1.10 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.11:*:*:*:*:*:*:* Versions 0.1.11 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.1.12:*:*:*:*:*:*:* Versions 0.1.12 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.3:*:*:*:*:*:*:* Versions 0.2.3 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.4:*:*:*:*:*:*:* Versions 0.2.4 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.5:*:*:*:*:*:*:* Versions 0.2.5 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.6:*:*:*:*:*:*:* Versions 0.2.6 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.7:*:*:*:*:*:*:* Versions 0.2.7 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.8:*:*:*:*:*:*:* Versions 0.2.8 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.9:*:*:*:*:*:*:* Versions 0.2.9 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.10:*:*:*:*:*:*:* Versions 0.2.10 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.11:*:*:*:*:*:*:* Versions 0.2.11 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.12:*:*:*:*:*:*:* Versions 0.2.12 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.13:*:*:*:*:*:*:* Versions 0.2.13 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.14:*:*:*:*:*:*:* Versions 0.2.14 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.15:*:*:*:*:*:*:* Versions 0.2.15 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.16:*:*:*:*:*:*:* Versions 0.2.16 Vulnerable ·masqmail
  • cpe:2.3:a:masqmail:masqmail:0.2.17:*:*:*:*:*:*:* Versions 0.2.17 Vulnerable ·masqmail

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-2663
  2. 2026-10-03 Alias added: GHSA-22g9-8497-wf8p

References

Patch 1

Advisory 1

Other 2

  • TI-2005-02526 masqmail before 0.2.18 allows remote attackers to execute arbitrary commands via crafted… CVSS 2.0HIGH 7.5
  • TI-2002-01223 Multiple buffer overflows in conf.c for Masqmail 0.1.x before 0.1.17, and 0.2.x before… CVSS 2.0HIGH 7.2
  • TI-2001-01126 Vulnerability in MasqMail before 0.1.15 allows local users to gain privileges via piped aliases. CVSS 2.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences