CVE-2007-2873: Spamassassin

Low severity, CVSS 1.9. EPSS: 0.3% chance of exploitation in the next 30 days.

SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.

Affected products

• Spamassassin Spamassassin: version 3.1.0 only; version 3.1.1 only; version 3.1.2 only; version 3.1.3 only; version 3.1.4 only; version 3.1.5 only; …

Published 2007-06-11. Last modified 2026-06-16.