Two vulnerabilities have been reported in Qpopper, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

1) An error where user supplied config and trace files are processed with escalated privileges, can be exploited to create or overwrite arbitrary files.

The vulnerability has been reported in version 4.0.5. Prior versions may also be affected.

2) An unspecified error can be exploited to create group or world-writable files.

Solution
Update to version 4.0.6.

Provided and/or discovered by
1) Jens Steube
2) Reported by vendor

Original Advisory
Gentoo:
http://www.gentoo.org/security/en/glsa/glsa-200505-17.xml

Deep Links
Links available to Secunia VIM customers