GCVE - cpe:2.3:a:postfix:postfix:2.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:postfix:postfix:2.6:*:*:*:*:*:*:*

part: a version: 2.6 update: *

Vendor	Postfix (`962d16ca-e87b-5ec2-b9a8-77023f312ab3`)
Product	Postfix (`aa944017-ba41-5e1f-9492-1b352519ce8b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/postfix`	purl2cpe	2026-06-01 10:11:44.493594
`pkg:deb/ubuntu/postfix`	purl2cpe	2026-06-01 10:11:44.493596
`pkg:gitlab/redhat/postfix`	purl2cpe	2026-06-01 10:11:44.493598
`pkg:npm/postfix`	purl2cpe	2026-06-01 10:11:44.493600
`pkg:rpm/fedora/postfix`	purl2cpe	2026-06-01 10:11:44.493601
`pkg:rpm/opensuse/postfix`	purl2cpe	2026-06-01 10:11:44.493603

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-1720`	vulnerable	2026-06-08 04:58:01.756732	Details available The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method. Published: 2011-05-13T17:00:00.000Z Updated: 2024-08-06T22:37:25.642Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/517917/100/0/threaded http://www.postfix.org/CVE-2011-1720.html http://secunia.com/advisories/44500 http://www.securityfocus.com/bid/47778 http://security.gentoo.org/glsa/glsa-201206-33.xml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0411`	vulnerable	2026-06-08 04:56:36.927979	Details available The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack. Published: 2011-03-16T22:00:00.000Z Updated: 2024-08-06T21:51:08.944Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html https://exchange.xforce.ibmcloud.com/vulnerabilities/65932 http://www.postfix.org/CVE-2011-0411.html http://secunia.com/advisories/43646 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3889`	vulnerable	2026-06-08 04:50:37.070701	Details available Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file. Published: 2008-09-12T16:00:00.000Z Updated: 2024-08-07T09:53:00.615Z Open on db.gcve.eu Reference links http://secunia.com/advisories/31986 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html http://secunia.com/advisories/32231 http://www.securityfocus.com/archive/1/496420/100/0/threaded http://secunia.com/advisories/31982	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

postfix 2.6

Notes

PURL mappings

Vulnerability references

Contribute