CVEvulnerability

CVE-2017-10140

7.8 HIGH Published 2018-04-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P

Description

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

Affected configurations

• postfix postfix (< 2.11.10) • postfix postfix (>= 3.0.0 < 3.0.10) • postfix postfix (>= 3.1.0 < 3.1.6) • postfix postfix (>= 3.2.0 < 3.2.2)

References