CVE-2016-6253

7.8 highEPSS 3.5%

High (7.8) in netbsd netbsd. EPSS 3.5% chance of exploitation in the next 30 days.

mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE: CWE-59
Published: 2017-01-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

netbsd:netbsd

References

http://akat1.pl/?id=2
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc
http://packetstormsecurity.com/files/138021/NetBSD-mail.local-8-Local-Root.html
http://www.rapid7.com/db/modules/exploit/unix/local/netbsd_mail_local
http://www.securityfocus.com/bid/92101

Check your stack JSON