Browse CVEs

HIGH 7.5 CVE-2026-43964 Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code th… Postfix 3.8.16 / 3.9.10+ Fix from $1,9502026-05-04 MEDIUM 5.3 CVE-2020-12063 A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated … Postfix No fix yet Fix from $1,6002020-04-24 HIGH 7.8 CVE-2017-10140 Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undo… Postfix 2.11.10 / 3.0.10+ Fix from $1,9502018-04-16 MEDIUM 6.5 CVE-2012-0811 Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL com… Postfix after 2.3.4 Fix from $1,6002014-10-01 MEDIUM 6.8 CVE-2011-1720EPSS 21% The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication met… Postfix Patch available Fix from $1,6002011-05-13 MEDIUM 6.8 CVE-2011-0411EPSS 16% The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restric… Postfix No fix yet Fix from $1,6002011-03-16 MEDIUM 6.9 CVE-2009-2939 The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, … Postfix No fix yet Fix from $1,6002009-09-21 MEDIUM 6.9 CVE-2008-4977 postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /t… Postfix No fix yet Fix from $1,6002008-11-06 MEDIUM 6.2 CVE-2008-2936 Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, al… Postfix Patch available Fix from $1,6002008-08-18