CVE-2017-10140
Published: 14 August 2017
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.
Notes
| Author | Note |
|---|---|
| sbeattie | see oss-sec for pam_ccreds example |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
db Launchpad, Ubuntu, Debian |
zesty |
Does not exist
|
| upstream |
Released
(5.1.29-9+deb8u1, 5.1.29-5+deb7u1)
|
|
| trusty |
Does not exist
(trusty was needed)
|
|
| xenial |
Does not exist
|
|
| artful |
Does not exist
|
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
|
db4.8 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
| zesty |
Does not exist
|
|
|
db6.0 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
(trusty was needed)
|
| upstream |
Needed
|
|
| zesty |
Does not exist
|
|
| artful |
Does not exist
|
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://patchwork.ozlabs.org/patch/866783/ |
||
|
db5.3 Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
| trusty |
Released
(5.3.28-3ubuntu3.1)
|
|
| xenial |
Released
(5.3.28-11ubuntu0.1)
|
|
| zesty |
Released
(5.3.28-12ubuntu0.1)
|
|
| artful |
Released
(5.3.28-13.1)
|
|
| bionic |
Released
(5.3.28-13.1)
|
|
| cosmic |
Released
(5.3.28-13.1)
|
|
| disco |
Released
(5.3.28-13.1)
|
|
|
Patches: vendor: https://src.fedoraproject.org/rpms/libdb/raw/8047fa8580659fcae740c25e91b490539b8453eb/f/db-5.3.28-cwd-db_config.patch |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.8 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |