(RHSA-2011:0307) Moderate: mailman security update

2011-03-0100:00:00

access.redhat.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

69.0%

JSON

Mailman is a program used to help manage email discussion lists.

Multiple input sanitization flaws were found in the way Mailman displayed
usernames of subscribed users on certain pages. If a user who is subscribed
to a mailing list were able to trick a victim into visiting one of those
pages, they could perform a cross-site scripting (XSS) attack against the
victim. (CVE-2011-0707)

Multiple input sanitization flaws were found in the way Mailman displayed
mailing list information. A mailing list administrator could use this flaw
to conduct a cross-site scripting (XSS) attack against victims viewing a
list’s “listinfo” page. (CVE-2008-0564, CVE-2010-3089)

Red Hat would like to thank Mark Sapiro for reporting the CVE-2011-0707 and
CVE-2010-3089 issues.

Users of mailman should upgrade to this updated package, which contains
backported patches to correct these issues.

OSVersionArchitecturePackageVersionFilename
RedHat5srcmailman< 2.1.9-6.el5_6.1mailman-2.1.9-6.el5_6.1.src.rpm
RedHat5x86_64mailman< 2.1.9-6.el5_6.1mailman-2.1.9-6.el5_6.1.x86_64.rpm
RedHat5ia64mailman< 2.1.9-6.el5_6.1mailman-2.1.9-6.el5_6.1.ia64.rpm
RedHatanyx86_64mailman< 2.1.5.1-34.rhel4.7mailman-2.1.5.1-34.rhel4.7.x86_64.rpm
RedHatanyppcmailman< 2.1.5.1-34.rhel4.7mailman-2.1.5.1-34.rhel4.7.ppc.rpm
RedHatanys390xmailman< 2.1.5.1-34.rhel4.7mailman-2.1.5.1-34.rhel4.7.s390x.rpm
RedHatanysrcmailman< 2.1.5.1-34.rhel4.7mailman-2.1.5.1-34.rhel4.7.src.rpm
RedHatanyia64mailman< 2.1.5.1-34.rhel4.7mailman-2.1.5.1-34.rhel4.7.ia64.rpm
RedHatanyi386mailman< 2.1.5.1-34.rhel4.7mailman-2.1.5.1-34.rhel4.7.i386.rpm
RedHat5i386mailman< 2.1.9-6.el5_6.1mailman-2.1.9-6.el5_6.1.i386.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	5	src	mailman	< 2.1.9-6.el5_6.1	mailman-2.1.9-6.el5_6.1.src.rpm
RedHat	5	x86_64	mailman	< 2.1.9-6.el5_6.1	mailman-2.1.9-6.el5_6.1.x86_64.rpm
RedHat	5	ia64	mailman	< 2.1.9-6.el5_6.1	mailman-2.1.9-6.el5_6.1.ia64.rpm
RedHat	any	x86_64	mailman	< 2.1.5.1-34.rhel4.7	mailman-2.1.5.1-34.rhel4.7.x86_64.rpm
RedHat	any	ppc	mailman	< 2.1.5.1-34.rhel4.7	mailman-2.1.5.1-34.rhel4.7.ppc.rpm
RedHat	any	s390x	mailman	< 2.1.5.1-34.rhel4.7	mailman-2.1.5.1-34.rhel4.7.s390x.rpm
RedHat	any	src	mailman	< 2.1.5.1-34.rhel4.7	mailman-2.1.5.1-34.rhel4.7.src.rpm
RedHat	any	ia64	mailman	< 2.1.5.1-34.rhel4.7	mailman-2.1.5.1-34.rhel4.7.ia64.rpm
RedHat	any	i386	mailman	< 2.1.5.1-34.rhel4.7	mailman-2.1.5.1-34.rhel4.7.i386.rpm
RedHat	5	i386	mailman	< 2.1.9-6.el5_6.1	mailman-2.1.9-6.el5_6.1.i386.rpm