CVE-2008-2937

Name	CVE-2008-2937
Description	Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postfix (PTS)	bullseye	3.5.25-0+deb11u1	fixed
	bookworm	3.7.11-0+deb12u1	fixed
	trixie	3.9.1-8	fixed
	sid	3.9.1-9	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
postfix	source	(unstable)	2.5.4-1	low

[etch] - postfix <no-dsa> (minor issue)