Every CVESearch/Get API key

CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this...

1.9 LowFix available

CVE-2008-2937 is a low vulnerability (CVSS 1.9) in Postfix, published August 18, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in postfix 2.5.4-1.

Severity
1.9 LowCVSS 2.0, NVD
Exploit chance
0.36%EPSS, 29th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.5.4-1postfix +17 more

Description

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Exploit likelihood

0.36%Down 1.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
postfix
Debian:12
before 2.5.4-1
2.5.4-1
postfix
Debian:13
before 2.5.4-1
2.5.4-1
postfix
Debian:14
before 2.5.4-1
2.5.4-1
postfix
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-pflogsumm
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-pflogsumm
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
Show 8 moreShow less
Affected packages
PackageAffectedFixed
postfix-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-pflogsumm
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix-pflogsumm
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
before 2:2.2.10-1.4.el4
2:2.2.10-1.4.el4
postfix
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
before 2:2.3.3-2.2.el5_6
2:2.3.3-2.2.el5_6
postfix-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
before 2:2.3.3-2.2.el5_6
2:2.3.3-2.2.el5_6
postfix-pflogsumm
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
before 2:2.3.3-2.2.el5_6
2:2.3.3-2.2.el5_6

What each source reports

NVD Score used1.9

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Record
CVE-2008-2937
CVSS 2.0
1.9 LowAV:L/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE ListNo score

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Record
CVE-2008-2937
Updated
2026-11-02
EUVDEUVD-2008-2930No score

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Record
EUVD-2008-2930
Updated
2026-11-03
GitHub AdvisoriesGHSA-44wx-mcwc-xfg9No score

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this...

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Record
GHSA-44wx-mcwc-xfg9
Weakness
CWE-200
Updated
2026-11-02
OSVNo score

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Record
CVE-2008-2937
Updated
2026-11-02
OSVDEBIAN-CVE-2008-2937No score

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.

Record
DEBIAN-CVE-2008-2937
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 24 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open