{"id":"CVE-2017-10140","aliases":["DEBIAN-CVE-2017-10140","DLA-1135-1","DLA-1136-1","DLA-1137-1","EUVD-2017-1787","GHSA-698c-frxg-8qf9","MGASA-2017-0380","UBUNTU-CVE-2017-10140","USN-3489-1"],"status":"published","title":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might...","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00547,"percentile":0.46125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-08-14T00:00:00Z","modified":"2026-09-01T20:03:41Z","fixes":[{"ecosystem":"Debian:12","package":"db5.3","fixed_in":["5.3.28-13.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"db5.3","fixed_in":["5.3.28-13.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"db5.3","fixed_in":["5.3.28-13.1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"db","fixed_in":["5.1.29-5+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"db4.8","fixed_in":["4.8.30-12+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"db4.7","fixed_in":["4.7.25-21+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"db48","fixed_in":["4.8.30-18.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"db53","fixed_in":["5.3.28-4.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"db48","fixed_in":["4.8.30-21.1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"db53","fixed_in":["5.3.28-10.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"db5.3","fixed_in":["5.3.28-3ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"db5.3","fixed_in":["5.3.28-11ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"db5.3","fixed_in":["5.3.28-13.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-13.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-13.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-13.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-5+deb7u1"}]}],"versions":["5.1.29-5"]},{"source":"osv","ecosystem":"Debian:7","package":"db4.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.30-12+deb7u1"}]}],"versions":["4.8.30-12"]},{"source":"osv","ecosystem":"Debian:7","package":"db4.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.25-21+deb7u1"}]}],"versions":["4.7.25-21"]},{"source":"osv","ecosystem":"Mageia:5","package":"db48","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.30-18.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"db53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-4.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"db48","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.30-21.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"db53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-10.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-3ubuntu3.1"}]}],"versions":["5.3.21-2","5.3.28-2","5.3.28-3","5.3.28-3ubuntu1","5.3.28-3ubuntu2","5.3.28-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-11ubuntu0.1"}]}],"versions":["5.3.28-11"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-3ubuntu3.1"}]}],"versions":["5.3.21-2","5.3.28-2","5.3.28-3","5.3.28-3ubuntu1","5.3.28-3ubuntu2","5.3.28-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"db5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.28-11ubuntu0.1"}]}],"versions":["5.3.28-11"]}],"products":[{"vendor":"postfix","product":"postfix"}],"references":[{"url":"http://seclists.org/oss-sec/2017/q3/285","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0366","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.postfix.org/announcements/postfix-3.2.2.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10140"},{"url":"https://github.com/advisories/GHSA-698c-frxg-8qf9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-10140","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0380.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21203","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2017/08/12/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4JKFB2V7HP5V4KCYKSXMTWUDWUWQOV3S/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-10140","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/08/12/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3489-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3489-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10140","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-10140","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2018-04-16T16:00:00Z","modified":"2024-08-05T17:33:16.056Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2017-1787","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2018-04-16T16:00:00Z","modified":"2024-08-05T17:33:16Z","updated_at":"2026-11-03T02:23:26.143318Z"}],"ghsa":[{"id":"GHSA-698c-frxg-8qf9","title":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might...","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2022-05-13T01:25:15Z","modified":"2023-02-01T05:07:14Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:30.568005Z"}],"nvd":[{"id":"CVE-2017-10140","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2018-04-16T17:29:00.22Z","modified":"2026-06-17T00:59:43.737Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"CVE-2017-10140","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2018-04-16T17:29:00.22Z","modified":"2026-04-16T06:25:27.056607072Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-10140","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2018-04-16T17:29:00.22Z","modified":"2026-09-01T20:03:41.080494531Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-10140","description":"Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.","status":"published","published":"2017-08-14T00:00:00Z","modified":"2026-04-22T11:09:27.324642Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1135-1","title":"db - security update","status":"published","published":"2017-10-18T00:00:00Z","modified":"2026-03-09T01:00:44.003634Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1136-1","title":"db4.8 - security update","status":"published","published":"2017-10-18T00:00:00Z","modified":"2026-03-09T01:00:58.918636Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1137-1","title":"db4.7 - security update","status":"published","published":"2017-10-18T00:00:00Z","modified":"2026-03-09T01:01:44.254262Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0380","title":"Updated db48 and db53 packages fix security vulnerability","description":"It was found that Berkeley DB reads the DB_CONFIG configuration file from the\ncurrent working directory by default. This happens when calling db_create()\nwith dbenv=NULL; or using the dbm_open() function (CVE-2017-10140).\n","status":"published","published":"2017-10-19T22:05:51Z","modified":"2026-04-16T06:24:15.79433405Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"USN-3489-1","title":"db5.3 vulnerability","description":"It was discovered that Berkeley DB incorrectly handled certain configuration files.\nAn attacker could possibly use this issue to read sensitive information.\n","status":"published","published":"2017-11-21T22:25:49Z","modified":"2026-04-22T09:41:33.327085Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}