← Vulnerability feed

Vulnerability record · CVE-2017-10140 · published 16 April 2018

CVE-2017-10140: Postfix vulnerability

Postfix · Postfix

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

7.8 CVSS 3.0 High EPSS 0.55% · top 56.4%
7.8CVSS 3.0 base score, v2 4.6
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://seclists.org/oss-sec/2017/q3/285 ExploitMailing ListThird Party Advisory
http://www.postfix.org/announcements/postfix-3.2.2.html Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0366 Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
http://seclists.org/oss-sec/2017/q3/285 ExploitMailing ListThird Party Advisory
http://www.postfix.org/announcements/postfix-3.2.2.html Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0366 Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html

Track CVE-2017-10140 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-43964Postfix vulnerabilityPostfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code th…EPSS 0.88%6.9CVE-2009-2939Postfix link following vulnerabilityThe postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, …EPSS 0.50%6.9CVE-2008-4977Postfix link following vulnerabilitypostfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /t…EPSS 0.37%6.8CVE-2011-1720Postfix memory buffer overflow vulnerabilityThe SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication met…EPSS 21%6.8CVE-2011-0411Postfix permissions and access controls vulnerabilityThe STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restric…EPSS 16%6.5CVE-2012-0811Postfix sql injection vulnerabilityMultiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL com…EPSS 1.7%6.2CVE-2008-2936Postfix permissions and access controls vulnerabilityPostfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, al…EPSS 0.99%5.3CVE-2023-51764Postfix insufficient verification of data authenticity vulnerabilityPostfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=c…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2017-10140), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.