Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libdb-devel-docUpgrade libdb-java-develUpgrade libdb-javaUpgrade libdb-devel-staticUpgrade libdb-sql-develUpgrade libdb-utilsUpgrade libdb-cxxUpgrade libdbUpgrade libdb-tcl-develUpgrade libdb-tclUpgrade libdb-cxx-develUpgrade libdb-sqlUpgrade libdb-develUpgrade libdb-debuginfo | Mar 7, 2023 | Apr 16, 2018 |
| Amazon_linux | — | Upgrade db4 | Apr 6, 2023 | Nov 21, 2017 |
| Apple Osx Postfix | — | Apply OS X security update 2017-001 SierraApply OS X security update 2017-004 El CapitanUpgrade macOS to the latest version | Nov 20, 2017 | Nov 20, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 16, 2018 |
| Debian | — | Upgrade dbUpgrade db5.3Upgrade db4.8Upgrade db4.7 | Feb 25, 2019 | Apr 16, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postfix-perl-scriptsUpgrade postfix | Jul 3, 2018 | Apr 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postfixUpgrade postfix-perl-scripts | Jul 3, 2018 | Apr 16, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libdb-utilsUpgrade libdbUpgrade libdb-devel | Sep 24, 2019 | Apr 16, 2018 |
| Oracle Solaris | — | Upgrade service/network/smtp/postfix to version 3.2.2-0.175.3.23.0.1.0 on Solaris 11.3 | Jun 18, 2018 | Apr 16, 2018 |
| Postfix | — | Upgrade to the latest version of Postfix | Jun 4, 2018 | Apr 16, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Jun 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2018 |
| Ubuntu | — | Upgrade libdb4.8Upgrade db5.3-utilUpgrade db4.8-utilUpgrade libdb5.1Upgrade libdb5.3Upgrade db5.1-util | Nov 22, 2017 | Nov 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub