/bin/mail which comes with the security upgraded mailx-8.1.1-16 for RH 5.2
seems to open the
/var/spool/mail/$USER readonly, and when it tries to delete or change the
flag on a message,
it dumpes core.
Believe it or not, people still use /bin/mail as reader.
I straced mailx on a 5.2 system with all applicable updates. mailx was at
8.1.1-16. /var/spool/mail/xxx was indeed opened O_RDONLY; however it was closed
and reopened O_WRONLY | O_TRUNC. Upon supplying d1 to the prompt the 1st and
only message was deleted.
Can't reproduce this bug.