Bugzilla Bug 135746

I assign the severity to major (C1) since the user usually can't check the
emails received before they are filtered by spamassassin, so it behaves like a
vulnerability against a server : the attacker only has to wait a few minutes or
hour before the malicious email. So *1. And C because this vuln only occurs if
the user modifies the init script or lauches spamd with particular options.

'3.1.3 fixes a remote code execution vulnerability if spamd is run with the
"--vpopmail" and "-P" options.  If either/both of those options are not
used, there is no vulnerability.  There was also a fix for the userstate
directory and prefs file not being created.'

Please bump 3.1.3 which was released yesterday

perl-herd done

ppc stable

Stable on hppa

stable on ppc64

No mo' spam fo' amd64 and x86...

(I swear, I'm about to strangle bugzilla today)

sparc stable.

alpha stable.

Thanks arches, this one is ready for GLSA

Since spamd is run as root, is there a hazard that the code would be executed
as root ??

*** Bug 135236 has been marked as a duplicate of this bug. ***

Unless you specify the -u option in /etc/conf.d/spamd it will run as root.

GLSA 200606-09.

ia64 please don't forget to mark stable to benifit from the GLSA.

Don't forget about mips.