CVE-2008-2937: Infoleak
Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2937?
CVE-2008-2937 is considered a medium severity vulnerability due to potential unauthorized access to email messages.
How do I fix CVE-2008-2937?
To fix CVE-2008-2937, you should upgrade Postfix to version 2.5.4 or later for the 2.5 series or 2.6-20080814 or later for the 2.6 series.
What are the affected versions for CVE-2008-2937?
CVE-2008-2937 affects Postfix versions 2.5.0 through 2.5.3 and 2.6.0 prior to the specified updates.
Can local users exploit CVE-2008-2937?
Yes, local users can exploit CVE-2008-2937 by creating a mailbox file corresponding to another user's account.
What impact does CVE-2008-2937 have on email privacy?
CVE-2008-2937 impacts email privacy by allowing unauthorized users to read email messages intended for other users.