MDVSA-2009:224-1
- Package name
- postfix
- Date
- 2009-12-04
- Advisory ID
- MDVSA-2009:224-1
- Affected versions
- 2008.0 i586 , 2008.0 x86_64
Problem description
A vulnerability has been found and corrected in postfix:
Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a
mailbox file even when this file is not owned by the recipient, which
allows local users to read e-mail messages by creating a mailbox file
corresponding to another user's account name (CVE-2008-2937).
This update provides a solution to this vulnerability.
Update:
Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers
Updated packages
2008.0 i586
dcccce93e12e86c6828c5d0ab64b60db 2008.0/i586/libpostfix1-2.4.5-2.3mdv2008.0.i586.rpm 20e55a81da8945bce9ba75a3fa0cc5ba 2008.0/i586/postfix-2.4.5-2.3mdv2008.0.i586.rpm bd80b48f07b01709fead701fb07b7d45 2008.0/i586/postfix-ldap-2.4.5-2.3mdv2008.0.i586.rpm 3222bbb3c04c9b019b21ac022752872a 2008.0/i586/postfix-mysql-2.4.5-2.3mdv2008.0.i586.rpm 5c94516257af665aa545c1d3192589b2 2008.0/i586/postfix-pcre-2.4.5-2.3mdv2008.0.i586.rpm a2391ec8cd9bb49c86f4b3c2ea9b0357 2008.0/i586/postfix-pgsql-2.4.5-2.3mdv2008.0.i586.rpm c6d4a5c36d9131b02b42586cb3e0cacb 2008.0/SRPMS/postfix-2.4.5-2.3mdv2008.0.src.rpm
2008.0 x86_64
bc509cca07a60d89f6e0fa3cd544ff65 2008.0/x86_64/lib64postfix1-2.4.5-2.3mdv2008.0.x86_64.rpm 6f4849980bde480ea49dccbe05808f0c 2008.0/x86_64/postfix-2.4.5-2.3mdv2008.0.x86_64.rpm e23e7d6fe949fea7eb39d8c6a96aa0b5 2008.0/x86_64/postfix-ldap-2.4.5-2.3mdv2008.0.x86_64.rpm beabc7a8336eda0e789e923e793d9521 2008.0/x86_64/postfix-mysql-2.4.5-2.3mdv2008.0.x86_64.rpm c6d62f79b946ec7661fd1206811c71c5 2008.0/x86_64/postfix-pcre-2.4.5-2.3mdv2008.0.x86_64.rpm 0e05a5809ee3301abce49c53afcb22a7 2008.0/x86_64/postfix-pgsql-2.4.5-2.3mdv2008.0.x86_64.rpm c6d4a5c36d9131b02b42586cb3e0cacb 2008.0/SRPMS/postfix-2.4.5-2.3mdv2008.0.src.rpm