David Watson has reported a vulnerability in getmail, which can be exploited by malicious, local users to gain escalated privileges.

The problem is caused due to insufficient validation of symbolic links when creating users' mail boxes and subdirectories. This can e.g. be exploited by a local user to replace the original mail box with a symbolic link in order to overwrite arbitrary files.

The vulnerability has been reported in versions prior to 3.2.5 and 4.2.0.

Solution
Update to version 3.2.5 or 4.2.0:
Further details available to Secunia VIM customers

Provided and/or discovered by
David Watson

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers