CVE-2017-10140
First published: Thu Jun 22 2017(Updated: )
It was found that Berkeley DB reads the DB_CONFIG configuration file from the current working directory by default. This happens when calling db_create() with dbenv=NULL; or using the dbm_open() function. References: <a href="http://seclists.org/oss-sec/2017/q2/452">http://seclists.org/oss-sec/2017/q2/452</a> <a href="http://www.postfix.org/announcements/postfix-3.2.2.html">http://www.postfix.org/announcements/postfix-3.2.2.html</a> Proposed patch: <a href="http://seclists.org/oss-sec/2017/q2/475">http://seclists.org/oss-sec/2017/q2/475</a>
Credit: an anonymous researcher an anonymous researcher cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple macOS High Sierra | <10.13.1 | 10.13.1 |
| Apple Sierra | ||
| Apple El Capitan | ||
| Postfix Postfix | <2.11.10 | |
| Postfix Postfix | >=3.0.0<3.0.10 | |
| Postfix Postfix | >=3.1.0<3.1.6 | |
| Postfix Postfix | >=3.2.0<3.2.2 | |
| Apple macOS High Sierra | <10.13 | 10.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT208144 (Advisory)
- https://support.apple.com/en-us/HT208221 (Advisory)
- http://seclists.org/oss-sec/2017/q3/285
- http://www.postfix.org/announcements/postfix-3.2.2.html
- https://access.redhat.com/errata/RHSA-2019:0366
- https://www.oracle.com/security-alerts/cpujul2020.html
- http://seclists.org/oss-sec/2017/q2/452
- http://seclists.org/oss-sec/2017/q2/475
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464033
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464035
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464034
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464032#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464032#c3
- http://pkgs.fedoraproject.org/cgit/rpms/libdb.git/commit/?id=8047fa8580659fcae740c25e91b490539b8453eb
- https://bugs.launchpad.net/ubuntu/+source/libnss-db/+bug/531976
- https://access.redhat.com/security/cve/CVE-2010-0826
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=580187
- https://access.redhat.com/security/updates/classification/
- https://bugzilla.redhat.com/show_bug.cgi?id=1464032
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2017-13832
- CVE-2016-0736
- CVE-2016-2161
- CVE-2016-5387
- CVE-2016-8740
- CVE-2016-8743
- CVE-2017-13909
- CVE-2017-13809
- CVE-2017-7084
- CVE-2017-7074
- CVE-2017-13820
- CVE-2017-13807
- CVE-2017-7143
- CVE-2017-13829
- CVE-2017-13833
- CVE-2017-7083
- CVE-2017-13821
- CVE-2017-0381
- CVE-2017-13825
- CVE-2017-13890
- CVE-2017-13851
- CVE-2017-7138
- CVE-2017-7121
- CVE-2017-7122
- CVE-2017-7123
- CVE-2017-7124
- CVE-2017-7125
- CVE-2017-7126
- CVE-2017-13815
- CVE-2017-13828
- CVE-2017-13811
- CVE-2017-13835
- CVE-2017-11103
- CVE-2017-13819
- CVE-2017-13830
- CVE-2017-13814
- CVE-2017-13831
- CVE-2017-13837
- CVE-2017-13906
- CVE-2017-7077
- CVE-2017-7119
- CVE-2017-7114
- CVE-2017-13810
- CVE-2017-13817
- CVE-2017-13818
- CVE-2017-13836
- CVE-2017-13841
- CVE-2017-13840
- CVE-2017-13842
- CVE-2017-13782
- CVE-2017-13843
- CVE-2017-13854
- CVE-2017-13834
- CVE-2017-13873
- CVE-2017-13827
- CVE-2017-13813
- CVE-2017-13816
- CVE-2017-13812
- CVE-2016-4736
- CVE-2017-7086
- CVE-2017-1000373
- CVE-2016-9063
- CVE-2017-9233
- CVE-2018-4302
- CVE-2017-5130
- CVE-2017-7376
- CVE-2017-9050
- CVE-2017-9049
- CVE-2017-7141
- CVE-2017-7078
- CVE-2017-6451
- CVE-2017-6452
- CVE-2017-6455
- CVE-2017-6458
- CVE-2017-6459
- CVE-2017-6460
- CVE-2017-6462
- CVE-2017-6463
- CVE-2017-6464
- CVE-2016-9042
- CVE-2017-13824
- CVE-2017-13846
- CVE-2017-10140
- CVE-2017-13822
- CVE-2017-7132
- CVE-2017-13823
- CVE-2017-13808
- CVE-2017-13838
- CVE-2017-7082
- CVE-2017-7080
- CVE-2017-13908
- CVE-2017-13839
- CVE-2017-13910
- CVE-2017-10989
- CVE-2017-7128
- CVE-2017-7129
- CVE-2017-7130
- CVE-2017-7127
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
- CVE-2017-3167
- CVE-2017-3169
- CVE-2017-7659
- CVE-2017-7668
- CVE-2017-7679
- CVE-2017-9788
- CVE-2017-9789
- CVE-2017-13786
- CVE-2017-13800
- CVE-2017-1000100
- CVE-2017-1000101
- CVE-2017-13801
- CVE-2017-13799
- CVE-2017-13852
- CVE-2017-5969
- CVE-2018-4390
- CVE-2018-4391
- CVE-2017-13907
- CVE-2017-7170
- CVE-2017-7150
- CVE-2017-13804
- CVE-2017-11108
- CVE-2017-11541
- CVE-2017-11542
- CVE-2017-11543
- CVE-2017-12893
- CVE-2017-12894
- CVE-2017-12895
- CVE-2017-12896
- CVE-2017-12897
- CVE-2017-12898
- CVE-2017-12899
- CVE-2017-12900
- CVE-2017-12901
- CVE-2017-12902
- CVE-2017-12985
- CVE-2017-12986
- CVE-2017-12987
- CVE-2017-12988
- CVE-2017-12989
- CVE-2017-12990
- CVE-2017-12991
- CVE-2017-12992
- CVE-2017-12993
- CVE-2017-12994
- CVE-2017-12995
- CVE-2017-12996
- CVE-2017-12997
- CVE-2017-12998
- CVE-2017-12999
- CVE-2017-13000
- CVE-2017-13001
- CVE-2017-13002
- CVE-2017-13003
- CVE-2017-13004
- CVE-2017-13005
- CVE-2017-13006
- CVE-2017-13007
- CVE-2017-13008
- CVE-2017-13009
- CVE-2017-13010
- CVE-2017-13011
- CVE-2017-13012
- CVE-2017-13013
- CVE-2017-13014
- CVE-2017-13015
- CVE-2017-13016
- CVE-2017-13017
- CVE-2017-13018
- CVE-2017-13019
- CVE-2017-13020
- CVE-2017-13021
- CVE-2017-13022
- CVE-2017-13023
- CVE-2017-13024
- CVE-2017-13025
- CVE-2017-13026
- CVE-2017-13027
- CVE-2017-13028
- CVE-2017-13029
- CVE-2017-13030
- CVE-2017-13031
- CVE-2017-13032
- CVE-2017-13033
- CVE-2017-13034
- CVE-2017-13035
- CVE-2017-13036
- CVE-2017-13037
- CVE-2017-13038
- CVE-2017-13039
- CVE-2017-13040
- CVE-2017-13041
- CVE-2017-13042
- CVE-2017-13043
- CVE-2017-13044
- CVE-2017-13045
- CVE-2017-13046
- CVE-2017-13047
- CVE-2017-13048
- CVE-2017-13049
- CVE-2017-13050
- CVE-2017-13051
- CVE-2017-13052
- CVE-2017-13053
- CVE-2017-13054
- CVE-2017-13055
- CVE-2017-13687
- CVE-2017-13688
- CVE-2017-13689
- CVE-2017-13690
- CVE-2017-13725
- CVE-2017-13077
- CVE-2017-13078
- CVE-2017-13080
Frequently Asked Questions
What is CVE-2017-10140?
CVE-2017-10140 is a vulnerability in Postfix that allows local users to gain privileges.
How does CVE-2017-10140 affect Postfix?
CVE-2017-10140 affects Postfix versions before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2.
What is the severity level of CVE-2017-10140?
The severity level of CVE-2017-10140 is high with a score of 7.8.
How can I fix CVE-2017-10140?
You can fix CVE-2017-10140 by updating Postfix to version 3.2.2.
Where can I find more information about CVE-2017-10140?
You can find more information about CVE-2017-10140 at the following references: [http://seclists.org/oss-sec/2017/q2/452](http://seclists.org/oss-sec/2017/q2/452), [http://www.postfix.org/announcements/postfix-3.2.2.html](http://www.postfix.org/announcements/postfix-3.2.2.html), [http://seclists.org/oss-sec/2017/q2/475](http://seclists.org/oss-sec/2017/q2/475)
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- collector/apple-support
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10140
- vendor/apple
- canonical/apple macos high sierra
- canonical/apple sierra
- canonical/apple el capitan
- vendor/postfix
- canonical/postfix postfix
- version/postfix postfix/3.0.0
- version/postfix postfix/3.1.0
- version/postfix postfix/3.2.0