CVE-2023-32182
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux...
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.
- Record
CVE-2023-32182- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2023-36450
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.
- Record
EUVD-2023-36450- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wcv5-982f-xggc
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux...
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.
- Record
GHSA-wcv5-982f-xggc- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.
- Record
CVE-2023-32182- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13416-1 No score
postfix-3.8.3-1.1 on GA media
These are all security issues fixed in the postfix-3.8.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13416-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3394-1 No score
Security update for postfix
This update for postfix fixes the following issues:
-
CVE-2023-32182: Fixed config_postfix SUSE specific script potentially bad /tmp file usage (bsc#1211196).
-
Update to from 3.7.2 to 3.7.3:
- Fixes a bug where some messages were not delivered after 'warning: Unexpected record type 'X'. (bsc#1213515)
- Record
SUSE-SU-2023:3394-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3732-1 No score
Security update for postfix
This update for postfix fixes the following issues:
Security fixes:
- CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196).
Other fixes:
- postfix: config.postfix causes too tight permission on main.cf (bsc#1215372).
- Record
SUSE-SU-2023:3732-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3791-1 No score
Security update for postfix
This update for postfix fixes the following issues:
Security fixes:
- CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196).
Other fixes:
- postfix: config.postfix causes too tight permission on main.cf (bsc#1215372).
- Record
SUSE-SU-2023:3791-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3945-1 No score
Security update for postfix
This update for postfix fixes the following issues:
Security fixes:
- CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196).
Other fixes:
- postfix: config.postfix causes too tight permission on main.cf (bsc#1215372).
- Record
SUSE-SU-2023:3945-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postfixSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 3.7.3-150500.3.5.1 | 3.7.3-150500.3.5.1 |
postfix-bdbSUSE:Linux Enterprise Module for Legacy 15 SP5 |
before 3.7.3-150500.3.5.1 | 3.7.3-150500.3.5.1 |
postfixSUSE:Linux Enterprise Module for Server Applications 15 SP5 |
before 3.7.3-150500.3.5.1 | 3.7.3-150500.3.5.1 |
postfixopenSUSE:Leap 15.5 |
before 3.7.3-150500.3.5.1 | 3.7.3-150500.3.5.1 |
postfix-bdbopenSUSE:Leap 15.5 |
before 3.7.3-150500.3.5.1 | 3.7.3-150500.3.5.1 |
postfixSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 3.2.10-3.27.2 | 3.2.10-3.27.2 |
postfixSUSE:Linux Enterprise Server 12 SP5 |
before 3.2.10-3.27.2 | 3.2.10-3.27.2 |
postfixSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 3.2.10-3.27.2 | 3.2.10-3.27.2 |
postfixopenSUSE:Leap 15.4 |
before 3.4.7-150200.3.12.2 | 3.4.7-150200.3.12.2 |
postfixSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postfix-bdbSUSE:Linux Enterprise Module for Legacy 15 SP4 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
postfixSUSE:Linux Enterprise Module for Server Applications 15 SP4 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
postfixSUSE:Manager Proxy 4.2 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
postfixSUSE:Manager Server 4.2 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
postfixopenSUSE:Leap 15.4 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
postfix-bdbopenSUSE:Leap 15.4 |
before 3.5.9-150300.5.12.2 | 3.5.9-150300.5.12.2 |
postfixopenSUSE:Tumbleweed |
before 3.8.3-1.1 | 3.8.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-32182 is a medium vulnerability (CVSS 5.9) in Opensuse Leap, published August 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in postfix 3.7.3-150500.3.5.1.