qpopper POP server creates lock files with predictable names, which allows local users to cause a denial of service for other users (lack of mail access) by creating lock files for other mail boxes.

Qpopper 2.53 and 3.0 does not properly identify the \n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 1023 characters long and ends in \n.

Buffer overflow in qpopper 3.0 beta versions allows local users to gain privileges via a long LIST command.

Buffer overflow in Qpopper (qpop) 3.0 allows remote root access via AUTH command.