transports/appendfile.c in Exim before 4.72 when MBX locking is enabled allows local users to change permissions of arbitrary files or create arbitrary files and cause a denial of service or possibly gain privileges via a symlink attack on a lockfile in /tmp/.