CVE-2009-2939

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2009-2939

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2009-2939.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2009-2939

Published

2009-09-21T19:30:00Z

Modified

2024-11-21T01:06:06Z

Summary

[none]

Details

The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.

References

Affected packages

Debian:11 / postfix

Package

Name: postfix
Purl: pkg:deb/debian/postfix?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.5-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / postfix

Package

Name: postfix
Purl: pkg:deb/debian/postfix?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.5-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / postfix

Package

Name: postfix
Purl: pkg:deb/debian/postfix?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.5-3

Ecosystem specific

{
    "urgency": "low"
}