GCVE - cpe:2.3:a:postfix:postfix:2.4.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:postfix:postfix:2.4.8:*:*:*:*:*:*:*

part: a version: 2.4.8 update: *

Vendor	Postfix (`962d16ca-e87b-5ec2-b9a8-77023f312ab3`)
Product	Postfix (`aa944017-ba41-5e1f-9492-1b352519ce8b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/postfix`	purl2cpe	2026-06-01 10:11:44.493390
`pkg:deb/ubuntu/postfix`	purl2cpe	2026-06-01 10:11:44.493392
`pkg:gitlab/redhat/postfix`	purl2cpe	2026-06-01 10:11:44.493394
`pkg:npm/postfix`	purl2cpe	2026-06-01 10:11:44.493395
`pkg:rpm/fedora/postfix`	purl2cpe	2026-06-01 10:11:44.493397
`pkg:rpm/opensuse/postfix`	purl2cpe	2026-06-01 10:11:44.493399

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-1720`	vulnerable	2026-06-08 04:58:01.745130	Details available The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method. Published: 2011-05-13T17:00:00.000Z Updated: 2024-08-06T22:37:25.642Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/517917/100/0/threaded http://www.postfix.org/CVE-2011-1720.html http://secunia.com/advisories/44500 http://www.securityfocus.com/bid/47778 http://security.gentoo.org/glsa/glsa-201206-33.xml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0411`	vulnerable	2026-06-08 04:56:36.916422	Details available The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack. Published: 2011-03-16T22:00:00.000Z Updated: 2024-08-06T21:51:08.944Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html https://exchange.xforce.ibmcloud.com/vulnerabilities/65932 http://www.postfix.org/CVE-2011-0411.html http://secunia.com/advisories/43646 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3889`	vulnerable	2026-06-08 04:50:37.069665	Details available Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file. Published: 2008-09-12T16:00:00.000Z Updated: 2024-08-07T09:53:00.615Z Open on db.gcve.eu Reference links http://secunia.com/advisories/31986 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html http://secunia.com/advisories/32231 http://www.securityfocus.com/archive/1/496420/100/0/threaded http://secunia.com/advisories/31982	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

postfix 2.4.8

Notes

PURL mappings

Vulnerability references

Contribute