Postfix - vulnerabilities (CVEs)
12 CVEs in 1 products, 0 in the last 30 days, newest from 2026-05-04.
Products
- Postfix - 12 CVEs
Newest CVEs of Postfix
- CVE-2026-43964 - CVSS 7.5 (high), 2026-05-04: Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks…
- CVE-2023-51764 - CVSS 5.3 (medium), 2023-12-24: Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking…
- CVE-2020-12063 - CVSS 5.3 (medium), 2020-04-24: A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the…
- CVE-2017-10140 - CVSS 7.8 (high), 2018-04-16: Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented…
- CVE-2012-0811 - CVSS 6.5 (medium), 2014-10-01: Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via…
- CVE-2011-1720 - CVSS 6.8 (medium), 2011-05-13: The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are…
- CVE-2011-0411 - CVSS 6.8 (medium), 2011-03-16: The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O…
- CVE-2009-2939 - CVSS 6.9 (medium), 2009-09-21: The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which…
- CVE-2008-4977 - CVSS 6.9 (medium), 2008-11-06: postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2)…
- CVE-2008-3889 - CVSS 2.1 (low), 2008-09-12: Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of…
- CVE-2008-2937 - CVSS 1.9 (low), 2008-08-18: Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to…
- CVE-2008-2936 - CVSS 6.2 (medium), 2008-08-18: Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows…
