Description
Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postfix | 2.5.4-1 | — |
| Debian 13 | postfix | 2.5.4-1 | — |
| Debian 12 | postfix | 2.5.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | postfix +1 | 2:2.3.3-2.2.el5_6 | RHSA-2011:0422 |
| RHEL 4 | postfix +1 | 2:2.2.10-1.4.el4 | RHSA-2011:0422 |
Advisories 1
- RHSA-2011:0422 Red Hat Security Advisory: postfix security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- FEDORA-2008-8595 vendor-advisory
- 32231 third-party-advisory
- MDVSA-2009:224 vendor-advisory
- FEDORA-2008-8593 vendor-advisory
- https://issues.rpath.com/browse/RPL-2689
- 20080821 rPSA-2008-0259-1 postfix mailing-list
- postfix-email-information-disclosure(44461) vdb-entry
- 30691 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2008-0259
- SUSE-SA:2008:040 vendor-advisory
- RHSA-2011:0422 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 31500 third-party-advisory
- 31477 third-party-advisory
- 31485 third-party-advisory
- ADV-2008-2385 vdb-entry
- GLSA-200808-12 vendor-advisory