{"id":"CVE-2016-4983","aliases":["AZL-44988","EUVD-2016-5951","GHSA-7cmr-c7xr-8xx6","SUSE-SU-2016:2915-1","openSUSE-SU-2024:10158-1"],"status":"published","title":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created...","description":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00398,"percentile":0.34272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2016-11-25T14:45:24Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","fixed_in":["2.2.13-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-1.1"}]}],"bundled":2}],"products":[{"vendor":"dovecot","product":"dovecot"},{"vendor":"fedora","product":"dovecot22"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=984639","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346055","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-11/msg00096.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4983","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7cmr-c7xr-8xx6"},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162915-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1003952","tags":["report"]},{"url":"https://bugzilla.suse.com/984639","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4983","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3430","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4983","description":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.","status":"published","published":"2019-11-05T21:45:36Z","modified":"2024-08-06T00:46:39.893Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5951","description":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.","status":"published","published":"2019-11-05T21:45:36Z","modified":"2024-08-06T00:46:39Z","updated_at":"2026-11-03T02:22:44.489595Z"}],"ghsa":[{"id":"GHSA-7cmr-c7xr-8xx6","title":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created...","description":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.","status":"published","published":"2022-05-24T17:00:19Z","modified":"2023-01-28T05:07:36Z","updated_at":"2026-11-02T14:44:33.090384Z"}],"nvd":[{"id":"CVE-2016-4983","description":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.","status":"published","published":"2019-11-05T22:15:10.923Z","modified":"2026-06-17T00:48:33.5Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"AZL-44988","title":"CVE-2016-4983 affecting package dovecot 2.3.20-1","description":"A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.","status":"published","published":"2019-11-05T22:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"openSUSE-SU-2024:10158-1","title":"dovecot22-2.2.27-1.1 on GA media","description":"These are all security issues fixed in the dovecot22-2.2.27-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:38.477842Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2915-1","title":"Security update for dovecot22","description":"\nThis update for dovecot22 fixes the following issues:\n\n  - insecure SSL/TLS key and certificate file creation (CVE-2016-4983) (bnc #984639)\n  - Fix LDAP based authentication for some setups (boo #1003952)\n\n","status":"published","published":"2016-11-25T14:45:24Z","modified":"2026-02-04T04:16:53.145015Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}