DSA-4664-1 mailman - security update

Bulletin has no description...

CVE-2020-12137

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

CVE-2020-12137

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

Code injection

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

CVE-2020-12137

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

UBUNTU-CVE-2020-12137

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

CVE-2020-12137

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

CVE-2020-12137

CVE-2020-12137 affects GNU Mailman 2.x up to version 2.1.30. The root cause is using the .obj extension for scrubbed application/octet-stream MIME parts, which can trigger MIME sniffing and lead to XSS in list-archive visitors when HTTP replies lack a MIME type. The connected advisories indicate ...

CVE-2020-12137

Removed by vendor...

PT-2020-3649 · Gnu +6 · Gnu Mailman +6

Name of the Vulnerable Software and Affected Versions: GNU Mailman versions 2.x through 2.1.29 GNU Mailman version 2.1.30 is not affected, but all versions prior to 2.1.30 are vulnerable. Description: The issue is related to the handling of MIME parts in GNU Mailman, which may contribute to...

CVE-2020-12137: Improper Neutralization of Input During Web Page Generation

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

Scientific Linux Security Update : mailman on SL7.x x86_64 (20200407)

mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages mailman: Mishandled URLs in Utils.py:GetPathPieces allows attackers to display arbitrary text on trusted sites C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. The vulnerability exists as multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting XSS attack against victims viewing ...

Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. The vulnerability exists as multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of...

Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. The vulnerability exists through multiple input sanitization flaws were found in the way Mailman displayed mailing list information. A mailing list administrator could use this flaw to conduct a cross-site scripting XSS attack against victims...

Phishing Attacks

mailman is vulnerable to phishing attacks. The vulnerability exists as a remote attacker could spoof messages in the error log, and possibly trick the administrator into visiting malicious URLs via a carriage return/line feed sequence in the URI...

Denial Of Service (DoS)

mailman is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way Mailman handled MIME multipart messages. An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to st...

Cross-Site Scripting (XSS)

mailman is vulnerable to cross-site scripting. Several cross-site scripting XSS issues were found in Mailman. An attacker could exploit these issues to perform cross-site scripting attacks against the Mailman administrator...

Denial Of Service (DoS)

Mailman is is vulnerable to Denial Of Service DoS. A flaw was found in the way Mailman handles MIME multipart messages. An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which would cause that particular mailing list to stop working...

Information Disclosure

mailman is vulnerable to information disclosure. A flaw in the truepath function of Mailman was discovered. A remote attacker who is a member of a private mailman list could use a carefully crafted URL and gain access to arbitrary files on the server...