CVE-2008-2937

Severity: low (CVSS 1.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-08-18 · updated 2026-06-16
Weakness: CWE-200

Description

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Affected products

Postfix: 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html
http://secunia.com/advisories/31477
http://secunia.com/advisories/31485
http://secunia.com/advisories/31500
http://secunia.com/advisories/32231
http://security.gentoo.org/glsa/glsa-200808-12.xml
http://wiki.rpath.com/Advisories:rPSA-2008-0259
http://www.mandriva.com/security/advisories?name=MDVSA-2009:224
http://www.redhat.com/support/errata/RHSA-2011-0422.html

Get alerted when CVE-2008-2937 or the next vulnerability affects your stack