Bugtraqmailing list archives

By Date

By Thread

[ GLSA 200501-29 ] Mailman: Cross-site scripting vulnerability

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 200501-29- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  Severity: Low     Title: Mailman: Cross-site scripting vulnerability      Date: January 22, 2005      Bugs: #77524        ID: 200501-29- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========Mailman is vulnerable to cross-site scripting attacks.Background==========Mailman is a Python-based mailing list server with an extensive webinterface.Affected packages=================    -------------------------------------------------------------------     Package           /  Vulnerable  /                     Unaffected    -------------------------------------------------------------------  1  net-mail/mailman     < 2.1.5-r3                       >= 2.1.5-r3Description===========Florian Weimer has discovered a cross-site scripting vulnerability inthe error messages that are produced by Mailman.Impact======By enticing a user to visiting a specially-crafted URL, an attacker canexecute arbitrary script code running in the context of the victim'sbrowser.Workaround==========There is no known workaround at this time.Resolution==========All Mailman users should upgrade to the latest version:    # emerge --sync    # emerge --ask --oneshot --verbose ">=net-mail/mailman-2.1.5-r3"References==========  [ 1 ] CAN-2004-1177http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1177Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:http://security.gentoo.org/glsa/glsa-200501-29.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity () gentoo org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2005 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.0

Attachment:_bin
Description:

By Date

By Thread

Current thread:

• [ GLSA 200501-29 ] Mailman: Cross-site scripting vulnerabilityLuke Macken (Jan 22)