CVE-2007-2873
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual...
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
Exploit likelihood
What each source reports
NVD Score used
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
- Record
CVE-2007-2873- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
- Record
CVE-2007-2873- Updated
- 2026-11-02
EUVDEUVD-2007-2865 No score
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
- Record
EUVD-2007-2865- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3p6-2cc8-h63h No score
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual...
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
- Record
GHSA-w3p6-2cc8-h63h- Updated
- 2026-11-02
OSV No score
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
- Record
CVE-2007-2873- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-2873 No score
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
- Record
DEBIAN-CVE-2007-2873- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11395-1 No score
perl-Mail-SpamAssassin-3.4.6-71.3 on GA media
These are all security issues fixed in the perl-Mail-SpamAssassin-3.4.6-71.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11395-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spamassassinDebian:12 |
before 3.2.1-1 | 3.2.1-1 |
spamassassinDebian:13 |
before 3.2.1-1 | 3.2.1-1 |
spamassassinDebian:14 |
before 3.2.1-1 | 3.2.1-1 |
spamassassinRed Hat:enterprise_linux:4::as |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassin-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassinRed Hat:enterprise_linux:4::desktop |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassin-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassinRed Hat:enterprise_linux:4::es |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassin-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassinRed Hat:enterprise_linux:4::ws |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spamassassin-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.1.9-1.el4 | 0:3.1.9-1.el4 |
spamassassinRed Hat:enterprise_linux:5::client |
before 0:3.1.9-1.el5 | 0:3.1.9-1.el5 |
spamassassin-debuginfoRed Hat:enterprise_linux:5::client |
before 0:3.1.9-1.el5 | 0:3.1.9-1.el5 |
spamassassinRed Hat:enterprise_linux:5::server |
before 0:3.1.9-1.el5 | 0:3.1.9-1.el5 |
spamassassin-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.1.9-1.el5 | 0:3.1.9-1.el5 |
spamassassinopenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 3.4.6-71.3 | 3.4.6-71.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-2873 is a low vulnerability (CVSS 1.9) in Spamassassin, published June 11, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in spamassassin 3.2.1-1.
References
issues.rpath.com/browse/RPL-1450
securitytracker.com/id?1018242
vupen.com/english/advisories/2007/2172
securityfocus.com/bid/24481
spamassassin.apache.org/advisories/cve-2007-2873.txt
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10354
Show 22 moreShow less
mandriva.com/security/advisories?name=MDKSA-2007:125
redhat.com/support/errata/RHSA-2007-0492.html
osvdb.org/37234
exchange.xforce.ibmcloud.com/vulnerabilities/34864
nvd.nist.gov/vuln/detail/CVE-2007-2873
github.com/advisories/GHSA-w3p6-2cc8-h63h
security-tracker.debian.org/tracker/CVE-2007-2873
access.redhat.com/errata/RHSA-2007:0492
bugzilla.redhat.com/show_bug.cgi?id=243455
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0492.json
cve.org/CVERecord?id=CVE-2007-2873
suse.com/security/cve/CVE-2007-0451