Gentoo Linux Security Advisory GLSA 200704-18 – CJ Kucera has discovered that some Courier-IMAP scripts don’t properly handle the XMAILDIR variable, allowing for shell command injection. Versions less than 4.0.6-r2 are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/56175/glsa-200704-18.txt
Source: https://packetstormsecurity.com/files/56175/Gentoo-Linux-Security-Advisory-200704-18.html