CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2008-4977
https://notcve.org/view.php?id=CVE-2008-4977
06 Nov 2008 — postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it. ** CUESTIONADA ** postfix_groups.pl en Postfix v2.5.2 permite a usuarios locales sobrescribir ficheros a su elección a través de un ataqu... • http://bugs.debian.org/496401 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 1CVE-2008-3889
https://notcve.org/view.php?id=CVE-2008-3889
12 Sep 2008 — Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file. Postfix versión 2.4 anteriores a la 2.4.9, versión 2.5 anteriores a la 2.5.5 y versión 2.6 anteriores a la 2.6-2000902, cuando se utiliza con el nucleo de Linux versión 2.6... • http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 28EXPL: 1CVE-2008-2936 – Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2008-2936
18 Aug 2008 — Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script. Postfix antes de 2.3.15, 2.4 anterior a 2.4.8, 2.5 anterior a 2.5.4 y 2.6 antes de 2.6-20080814, cuando el sistema o... • https://www.exploit-db.com/exploits/6337 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2008-2937 – postfix improper mailbox permissions
https://notcve.org/view.php?id=CVE-2008-2937
18 Aug 2008 — Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name. Postfix 2.5 anterior a 2.5.4 y 2.6 anterior a 2.6-20080814 envía a un archivo buzón incluso cuando este archivo no es propiedad del receptor, lo que permite a usuarios locales leer mensajes de correo creando un archivo buzón correspondiente con el nombre de c... • ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •