Medium: mailman

Issue Overview:

It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman. (CVE-2015-2775)

It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives. (CVE-2002-0389)

Affected Packages:

mailman

Issue Correction:
Run yum update mailman to update your system.

New Packages:

i686:  
    mailman-2.1.15-21.20.amzn1.i686  
    mailman-debuginfo-2.1.15-21.20.amzn1.i686  
  
src:  
    mailman-2.1.15-21.20.amzn1.src  
  
x86_64:  
    mailman-debuginfo-2.1.15-21.20.amzn1.x86_64  
    mailman-2.1.15-21.20.amzn1.x86_64  

Additional References

Red Hat: CVE-2002-0389, CVE-2015-2775

Mitre: CVE-2002-0389, CVE-2015-2775