A vulnerability was found in mailx. It was found that the privilege-separated child does not strip path separators from arguments. This potentially allows for a local privilege escalation. References: https://www.mail-archive.com/s-nail-users@lists.sourceforge.net/msg00551.html http://seclists.org/oss-sec/2017/q1/212 Upstream patches: https://git.sdaoden.eu/cgit/s-nail.git/commit/?id=f797c27efecad45af191c518b7f87fda32ada160 https://git.sdaoden.eu/cgit/s-nail.git/commit/?id=f2699449b66dd702a98925bd1b11153a6f7294bf
Fedora still uses the old mailx-12.5 (from Heirloom project). It looks that vulnerability had appeared in the new, forked code only (from git.sdaoden.eu), since there are no any "privsep.c" files in the 12.5 version.
(In reply to Dmitry Butskoy from comment #1) > Fedora still uses the old mailx-12.5 (from Heirloom project). > > It looks that vulnerability had appeared in the new, forked code only (from > git.sdaoden.eu), since there are no any "privsep.c" files in the 12.5 > version. This indeed seems to be the case. Thanks for the input! I have changed fedora to notaffected.
BTW RHEL6/RHEL7 seem not affected too...
As noted above, this is s-nail issue, not affecting mailx.
CVE assignment: http://seclists.org/oss-sec/2017/q1/329