Description of problem:
Thomas Biege from SuSE/Novell describes with "SUSE Security Announcement:
postfix (SUSE-SA:2008:040)", that they've fixed a security issue (CVE-2008-
2936, CVE-2008-2937: Postfix local privilege escalation and mbox ownership 
problem) which seems to apply for all RHEL and Fedora products as well, but
I can't see a Red Hat or Fedora specific update for this; from the e-mail
from SuSE/Novell to all openSUSE, SLES and SLED customers:

--- snipp ---
1) Problem Description and Brief Discussion

   Postfix is a well known MTA.
   During a source code audit the SuSE Security-Team discovered a local
   privilege escalation bug (CVE-2008-2936) as well as a mailbox ownership
   problem (CVE-2008-2937) in postfix.
   The first bug allowed local users to execute arbitrary commands as root
   while the second one allowed local users to read other users mail.

2) Solution or Work-Around

   Please install the update package.
--- snapp ---

Version-Release number of selected component (if applicable):
Postfix <= 2.5.1 as it seems.

Actual results:
No update with fix for Red Hat and/or Fedora.

Expected results:
Update with security fix for Red Hat and Fedora.