Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libdb-sqlUpgrade libdb-cxx-develUpgrade libdb-cxxUpgrade libdb-tclUpgrade libdb-develUpgrade libdb-tcl-develUpgrade libdbUpgrade libdb-debuginfoUpgrade libdb-devel-docUpgrade libdb-devel-staticUpgrade libdb-javaUpgrade libdb-sql-develUpgrade libdb-utilsUpgrade libdb-java-devel | Mar 7, 2023 | Apr 16, 2018 |
| Amazon_linux | — | Upgrade db4 | Apr 6, 2023 | Nov 21, 2017 |
| Apple Osx Postfix | — | Apply OS X security update 2017-004 El CapitanUpgrade macOS to the latest versionApply OS X security update 2017-001 Sierra | Nov 20, 2017 | Nov 20, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 16, 2018 |
| Debian | — | Upgrade db4.7Upgrade db4.8Upgrade db5.3Upgrade db | Feb 25, 2019 | Apr 16, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postfix-perl-scriptsUpgrade postfix | Jul 3, 2018 | Apr 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postfix-perl-scriptsUpgrade postfix | Jul 3, 2018 | Apr 16, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libdb-utilsUpgrade libdbUpgrade libdb-devel | Sep 24, 2019 | Apr 16, 2018 |
| Oracle Solaris | — | Upgrade service/network/smtp/postfix to version 3.2.2-0.175.3.23.0.1.0 on Solaris 11.3 | Jun 18, 2018 | Apr 16, 2018 |
| Postfix | — | Upgrade to the latest version of Postfix | Jun 4, 2018 | Apr 16, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Jun 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2018 |
| Ubuntu | — | Upgrade db5.3-utilUpgrade db4.8-utilUpgrade libdb4.8Upgrade libdb5.1Upgrade libdb5.3Upgrade db5.1-util | Nov 22, 2017 | Nov 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub