CVE-2016-4983
A postinstall script in the dovecot rpm allows local users to read the contents of newly created...
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
- Record
CVE-2016-4983- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
CVE List No score
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
- Record
CVE-2016-4983- Updated
- 2026-11-02
EUVDEUVD-2016-5951 No score
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
- Record
EUVD-2016-5951- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7cmr-c7xr-8xx6 No score
A postinstall script in the dovecot rpm allows local users to read the contents of newly created...
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
- Record
GHSA-7cmr-c7xr-8xx6- Updated
- 2026-11-02
OSVAZL-44988
CVE-2016-4983 affecting package dovecot 2.3.20-1
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
- Record
AZL-44988- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVopenSUSE-SU-2024:10158-1 No score
dovecot22-2.2.27-1.1 on GA media
These are all security issues fixed in the dovecot22-2.2.27-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10158-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2915-1 No score
Security update for dovecot22
This update for dovecot22 fixes the following issues:
- insecure SSL/TLS key and certificate file creation (CVE-2016-4983) (bnc #984639)
- Fix LDAP based authentication for some setups (boo #1003952)
- Record
SUSE-SU-2016:2915-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dovecotAzure Linux:3 |
through 2.3.20-1 | None known |
dovecot22SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22SUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22SUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP1 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22SUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP2 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22SUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.2.13-4.1 | 2.2.13-4.1 |
dovecot22openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.2.27-1.1 | 2.2.27-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4983 is a low vulnerability (CVSS 3.3) in Dovecot, published November 25, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in dovecot22 2.2.13-4.1.