PO
Product
Postfix
12
CVEs
0
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 2Low 0
Watch
Add Postfix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-10140 | 7.8 | Apr 16 | Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in… Affected: before 2.11.10; 3.0.0 before 3.0.10; 3.1.0 before 3.1.6; 3.2.0 before 3.2.2 |
| CVE-2026-43964 | 7.5 | May 4 | Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third… Affected: 2.3 before 3.8.16; 3.9 before 3.9.10; 3.10 before 3.10.9 |
| CVE-2023-51764 | 5.3 | Dec 24 | Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other… Affected: before 3.5.23; 3.6.0 before 3.6.13; 3.7.0 before 3.7.9; 3.8.0 before 3.8.4 |
| CVE-2020-12063 | 5.3 | Apr 24 | A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf… Affected: 2.10.1 |
| CVE-2012-0811 | – | Oct 1 | Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter… Affected: through 2.3.4; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2011-1720 | – | May 13 | The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2011-0411 | – | Mar 16 | The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows… Affected: 2.4; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +34 more |
| CVE-2009-2939 | – | Sep 21 | The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users… Affected: 2.5.5 |
| CVE-2008-4977 | – | Nov 6 | postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and… Affected: 2.5.2 |
| CVE-2008-3889 | – | Sep 12 | Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix"… Affected: 2.4; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +8 more |
| CVE-2008-2936 | – | Aug 18 | Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append… Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; +22 more |
| CVE-2008-2937 | – | Aug 18 | Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.6.0 |
Showing 12