CVE-2016-6253

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://akat1.pl/?id=2Exploit, Third Party Advisory
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.ascVendor Advisory
http://packetstormsecurity.com/files/138021/NetBSD-mail.local-8-Local-Root.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/unix/local/netbsd_mail_localExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/92101Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036429Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/40141/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/40385/Exploit, Third Party Advisory, VDB Entry
http://akat1.pl/?id=2Exploit, Third Party Advisory
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.ascVendor Advisory
http://packetstormsecurity.com/files/138021/NetBSD-mail.local-8-Local-Root.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/unix/local/netbsd_mail_localExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/92101Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036429Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/40141/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/40385/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-62549.1Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers t CVE-2016-62557.5Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without CVE-2016-62569.6SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to CVE-2016-62576.5The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM60 CVE-2016-62588.8The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by CVE-2016-62596.2Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which CVE-2016-62617.5The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bo CVE-2016-62627.5idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which trigger CVE-2016-62637.5The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of serv CVE-2016-62647.5Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a den CVE-2016-62655.5Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (CVE-2016-62668.8ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows r