CVE-2017-10140

high

Description

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

References

http://seclists.org/oss-sec/2017/q3/285

http://www.postfix.org/announcements/postfix-3.2.2.html

https://access.redhat.com/errata/RHSA-2019:0366

https://www.oracle.com/security-alerts/cpujul2020.html

Details

Source: MITRE

Published: 2018-04-16

Updated: 2020-07-15

Risk Information

CVSS v2

Base Score: 4.6

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH