Lucene search

K
osvGoogleOSV:DLA-186-1
HistoryApr 06, 2015 - 12:00 a.m.

mailman - security update

2015-04-0600:00:00
Google
osv.dev
5

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

A path traversal vulnerability was discovered in Mailman, the mailing
list manager. Installations using a transport script (such as
postfix-to-mailman.py) to interface with their MTA instead of static
aliases were vulnerable to a path traversal attack. To successfully
exploit this, an attacker needs write access on the local file system.

For Debian 6 Squeeze, these issues have been fixed in mailman version 1:2.1.13-6

CPENameOperatorVersion
mailmaneq1:2.1.13-4.1
mailmaneq1:2.1.13-5

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C