CVE-2017-10140
Public on 2018-04-16
Modified on 2024-05-03
Description
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.
Severity
Important
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| HAQM Linux 1 | db4 | 2023-03-30 | ALAS-2023-1726 | Fixed |
| HAQM Linux 2 - Core | libdb | 2023-03-02 | ALAS2-2023-1965 | Fixed |
| HAQM Linux 2023 | libdb | Not Affected | ||
| HAQM Linux 1 | postfix | Not Affected | ||
| HAQM Linux 2 - Core | postfix | Not Affected | ||
| HAQM Linux 2023 | postfix | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| HAQM Linux | CVSSv3 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | CVSSv2 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| NVD | CVSSv3 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |