Security update for postfix SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3791-1 Final 1 1 2023-09-26T15:34:52Z current 2023-09-26T15:34:52Z 2023-09-26T15:34:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postfix This update for postfix fixes the following issues: Security fixes: - CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196). Other fixes: - postfix: config.postfix causes too tight permission on main.cf (bsc#1215372). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2023-3791,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2023-3791,SUSE-2023-3791,openSUSE-SLE-15.4-2023-3791 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233791-1/ Link for SUSE-SU-2023:3791-1 https://lists.suse.com/pipermail/sle-security-updates/2023-September/016330.html E-Mail link for SUSE-SU-2023:3791-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211196 SUSE Bug 1211196 https://bugzilla.suse.com/1215372 SUSE Bug 1215372 https://www.suse.com/security/cve/CVE-2023-32182/ SUSE CVE CVE-2023-32182 page Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production openSUSE Leap 15.4 postfix-3.4.7-150200.3.12.2 postfix-devel-3.4.7-150200.3.12.2 postfix-doc-3.4.7-150200.3.12.2 postfix-lmdb-3.4.7-150200.3.12.2 postfix-mysql-3.4.7-150200.3.12.2 postfix-postgresql-3.4.7-150200.3.12.2 postfix-3.4.7-150200.3.12.2 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production postfix-3.4.7-150200.3.12.2 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production postfix-lmdb-3.4.7-150200.3.12.2 as a component of openSUSE Leap 15.4 A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1. CVE-2023-32182 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:postfix-3.4.7-150200.3.12.2 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:postfix-3.4.7-150200.3.12.2 openSUSE Leap 15.4:postfix-lmdb-3.4.7-150200.3.12.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233791-1/ https://www.suse.com/security/cve/CVE-2023-32182.html CVE-2023-32182 https://bugzilla.suse.com/1211196 SUSE Bug 1211196