lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.Referenceshttp://www.debian.org/security/2005/dsa-791
