CVE-2006-5297

Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.

Published: 2006-10-16 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2006-5297 is rated Low Risk (14.1/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.34%). Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2006-5297

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.08% 0.34% +0.27%
2 2025-03-17 0.04% 0.08% +0.03%
3 2023-03-07 — 0.04% —

Full EPSS history (4 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2006-5297

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
1.2 2.0 LOW
AV:L/AC:H/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:H)
Exploitation requires uncommon or highly specific conditions.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 1.9 2.9 [email protected]

Weakness enumeration for CVE-2006-5297

OS Trackers for CVE-2006-5297

vendor priority summary link
alpine — CVE-2006-5297: no source package rows; 0 state rows across 0 repos (none); fixed 0, open 0. https://security.alpinelinux.org/vuln/CVE-2006-5297
debian low CVE-2006-5297 low priority: Debian including 1 source packages (mutt), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2006-5297
redhat low — https://access.redhat.com/security/cve/CVE-2006-5297
ubuntu medium CVE-2006-5297 medium priority: Ubuntu including 1 source packages (mutt), 4 status rows across 4 suites (dapper, edgy, feisty, upstream): released 3, needs-triage 1. https://ubuntu.com/security/CVE-2006-5297

NVD evaluator notes for CVE-2006-5297

Solution: Race Condition occurs when creating temporary files in an NFS filesystem.

Vendor comments (NVD) for CVE-2006-5297

  • Red Hat (2007-09-07T00:00:00)

    Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=211085 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. The risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.

Affected software / configurations for CVE-2006-5297

Vendor Product Version Raw CPE
mutt mutt <= 1.5.12 cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:*
mutt mutt 0.95.6 cpe:2.3:a:mutt:mutt:0.95.6:*:*:*:*:*:*:*
mutt mutt 1.2.1 cpe:2.3:a:mutt:mutt:1.2.1:*:*:*:*:*:*:*
mutt mutt 1.2.5 cpe:2.3:a:mutt:mutt:1.2.5:*:*:*:*:*:*:*
mutt mutt 1.2.5.1 cpe:2.3:a:mutt:mutt:1.2.5.1:*:*:*:*:*:*:*
mutt mutt 1.2.5.4 cpe:2.3:a:mutt:mutt:1.2.5.4:*:*:*:*:*:*:*
mutt mutt 1.2.5.5 cpe:2.3:a:mutt:mutt:1.2.5.5:*:*:*:*:*:*:*
mutt mutt 1.2.5.12 cpe:2.3:a:mutt:mutt:1.2.5.12:*:*:*:*:*:*:*
mutt mutt 1.2.5.12_ol cpe:2.3:a:mutt:mutt:1.2.5.12_ol:*:*:*:*:*:*:*
mutt mutt 1.3.12 cpe:2.3:a:mutt:mutt:1.3.12:*:*:*:*:*:*:*
mutt mutt 1.3.12.1 cpe:2.3:a:mutt:mutt:1.3.12.1:*:*:*:*:*:*:*
mutt mutt 1.3.16 cpe:2.3:a:mutt:mutt:1.3.16:*:*:*:*:*:*:*
mutt mutt 1.3.17 cpe:2.3:a:mutt:mutt:1.3.17:*:*:*:*:*:*:*
mutt mutt 1.3.22 cpe:2.3:a:mutt:mutt:1.3.22:*:*:*:*:*:*:*
mutt mutt 1.3.24 cpe:2.3:a:mutt:mutt:1.3.24:*:*:*:*:*:*:*
mutt mutt 1.3.25 cpe:2.3:a:mutt:mutt:1.3.25:*:*:*:*:*:*:*
mutt mutt 1.3.27 cpe:2.3:a:mutt:mutt:1.3.27:*:*:*:*:*:*:*
mutt mutt 1.3.28 cpe:2.3:a:mutt:mutt:1.3.28:*:*:*:*:*:*:*
mutt mutt 1.4.0 cpe:2.3:a:mutt:mutt:1.4.0:*:*:*:*:*:*:*
mutt mutt 1.4.1 cpe:2.3:a:mutt:mutt:1.4.1:*:*:*:*:*:*:*
mutt mutt 1.4.2 cpe:2.3:a:mutt:mutt:1.4.2:*:*:*:*:*:*:*
mutt mutt 1.4.2.1 cpe:2.3:a:mutt:mutt:1.4.2.1:*:*:*:*:*:*:*
mutt mutt 1.5.3 cpe:2.3:a:mutt:mutt:1.5.3:*:*:*:*:*:*:*
mutt mutt 1.5.10 cpe:2.3:a:mutt:mutt:1.5.10:*:*:*:*:*:*:*

References for CVE-2006-5297

cvelogic Threat Intelligence