Every CVE Search/ Get API key

CVE-2008-2936

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the...

6.2 MediumPublic exploitFix available

CVE-2008-2936 is a medium vulnerability (CVSS 6.2) in Postfix, published August 14, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in postfix 2.5.4-1.

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Exploit likelihood

0.99%Down 2.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.2

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Record
CVE-2008-2936
CVSS 2.0
6.2 MediumAV:L/AC:H/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Record
CVE-2008-2936
Updated
2026-11-02
EUVDEUVD-2008-2929 No score

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Record
EUVD-2008-2929
Updated
2026-11-03
GitHub AdvisoriesGHSA-8739-vxjm-m9p4 No score

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the...

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Record
GHSA-8739-vxjm-m9p4
Updated
2026-11-02
OSV No score

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Record
CVE-2008-2936
Updated
2026-11-02
OSVDEBIAN-CVE-2008-2936 No score

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Record
DEBIAN-CVE-2008-2936
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
postfix
Debian:12
 before 2.5.4-1
2.5.4-1
postfix
Debian:13
 before 2.5.4-1
2.5.4-1
postfix
Debian:14
 before 2.5.4-1
2.5.4-1
postfix
Debian:4.0
 before 2.3.8-2etch1, plus listed versions
2.3.8-2
2.3.8-2etch1
postfix
Debian:4.0
 before 2.3.8-2+etch1, plus listed versions
2.3.8-22.3.8-2etch1
2.3.8-2+etch1
postfix
Debian:5.0
 before 2.5.2-2lenny1
2.5.2-2lenny1
postfix
Red Hat:enterprise_linux:3::as
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix-debuginfo
Red Hat:enterprise_linux:3::as
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix
Red Hat:enterprise_linux:3::desktop
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
Show 22 moreShow less
Affected packages
PackageAffectedFixed
postfix
Red Hat:enterprise_linux:3::es
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix-debuginfo
Red Hat:enterprise_linux:3::es
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix
Red Hat:enterprise_linux:3::ws
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix-debuginfo
Red Hat:enterprise_linux:3::ws
 before 2:2.0.16-14.1.RHEL3
2:2.0.16-14.1.RHEL3
postfix
Red Hat:enterprise_linux:4::as
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-debuginfo
Red Hat:enterprise_linux:4::as
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-pflogsumm
Red Hat:enterprise_linux:4::as
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix
Red Hat:enterprise_linux:4::desktop
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-pflogsumm
Red Hat:enterprise_linux:4::desktop
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix
Red Hat:enterprise_linux:4::es
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-debuginfo
Red Hat:enterprise_linux:4::es
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-pflogsumm
Red Hat:enterprise_linux:4::es
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix
Red Hat:enterprise_linux:4::ws
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-debuginfo
Red Hat:enterprise_linux:4::ws
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix-pflogsumm
Red Hat:enterprise_linux:4::ws
 before 2:2.2.10-1.2.1.el4_7
2:2.2.10-1.2.1.el4_7
postfix
Red Hat:enterprise_linux:5::client
 before 2:2.3.3-2.1.el5_2
2:2.3.3-2.1.el5_2
postfix-debuginfo
Red Hat:enterprise_linux:5::client
 before 2:2.3.3-2.1.el5_2
2:2.3.3-2.1.el5_2
postfix-pflogsumm
Red Hat:enterprise_linux:5::client
 before 2:2.3.3-2.1.el5_2
2:2.3.3-2.1.el5_2
postfix
Red Hat:enterprise_linux:5::server
 before 2:2.3.3-2.1.el5_2
2:2.3.3-2.1.el5_2
postfix-debuginfo
Red Hat:enterprise_linux:5::server
 before 2:2.3.3-2.1.el5_2
2:2.3.3-2.1.el5_2
postfix-pflogsumm
Red Hat:enterprise_linux:5::server
 before 2:2.3.3-2.1.el5_2
2:2.3.3-2.1.el5_2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPostfix 2.6-20080814 - 'symlink' Local Privilege Escalation2008-08-31

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open