# CVE-1999-1187: University of Washington Pine privilege escalation via lockfile symlink

Source: https://junglewise.ai/threats/cve-1999-1187-university-of-washington-pine-privilege-escalation-via-lockfile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-08-26. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1187 · Severity: medium · CVSS 4.6 · Published 1996-08-26

Pine, a popular email client for Unix-based systems, contains a security flaw in how it handles temporary files. A local user on the same system can exploit this to gain the privileges of another user, potentially leading to unauthorized access to private files or account takeover. This issue is particularly relevant for shared computing environments where multiple users log into the same server.

Technologies: [Freebsd](https://junglewise.ai/threats/technologies/freebsd), [Slackware Linux](https://junglewise.ai/threats/technologies/slackware-linux). Vendors: [Freebsd](https://junglewise.ai/threats/vendors/freebsd), [Slackware](https://junglewise.ai/threats/vendors/slackware), [University Of Washington](https://junglewise.ai/threats/vendors/university-of-washington).

## Quick answers

**Is CVE-1999-1187 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1187 being exploited in the wild.

**How severe is CVE-1999-1187?** Medium severity, with a CVSS score of 4.6, published 26 August 1996.

**Which products and versions are affected?** University of Washington Pine before 3.94.

**Is there a fix for CVE-1999-1187?** A patch was published on 1996-08-26: Confirmed fixed in version 3.95; advisory states fixed in 3.94 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-1999-1187 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-1999-1187?** Check whether you run Freebsd, Slackware Linux or University Of Washington Pine. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A symbolic link vulnerability exists in Pine's mail handling logic. When a user receives new mail, Pine creates a lockfile in the /tmp directory using a predictable naming convention (e.g., .[pid].[hex]). Because these files are created with world-writable permissions (mode 666) and the names are guessable, a local attacker can create a symbolic link from the expected lockfile path to a sensitive file owned by the victim (such as .rhosts). When Pine attempts to write the process ID to the lockfile, it instead writes to the linked file, allowing the attacker to modify its contents and escalate privileges. This issue was addressed in version 3.94 and later.

## Affected products

- University of Washington Pine before 3.94

## Timeline

- 1996-08-26: disclosed: Initial bug report on Bugtraq by Sean B. Hamor
- 1996-08-26: advisory: NVD publication date
- 1996-08-26: patched: Confirmed fixed in version 3.95; advisory states fixed in 3.94

## References

- [http://marc.info/?l=bugtraq&m=87602167419803&w=2](http://marc.info/?l=bugtraq&m=87602167419803&w=2)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/416](https://exchange.xforce.ibmcloud.com/vulnerabilities/416)

## Related threats

- [FreeBSD kqueue out-of-bounds read in fork copy](https://junglewise.ai/threats/cve-2026-58100-kqueue-fork-copy-knote-indexed-into-the-child-s-file-descriptor)
- [FreeBSD kernel kqueue memory safety bugs in copy-on-fork](https://junglewise.ai/threats/cve-2026-58099-when-copying-knotes-from-a-parent-kqueue-to-a-child-the-copy-code)
- [FreeBSD kernel heap out-of-bounds access in semop(2)](https://junglewise.ai/threats/cve-2026-58098-when-semop-2-blocks-waiting-for-a-semaphore-condition-it-releases)
- [FreeBSD sound(4) use-after-free in buffer resize TOCTOU race](https://junglewise.ai/threats/cve-2026-101308-when-an-audio-channel-s-buffer-needs-to-be-resized-the-sound-4)
- [FreeBSD RACK stack buffer overflow in tcp_rack](https://junglewise.ai/threats/cve-2026-101307-when-the-pcm-sample-array-needs-to-grow-the-rack-stack-doubles-a)