Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-2775 (GCVE-0-2015-2775)
Vulnerability from cvelistv5
- n/a
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T05:24:38.852Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "name": "DSA-3214", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2015/dsa-3214" }, { "name": "RHSA-2015:1153", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "name": "RHSA-2015:1417", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "name": "FEDORA-2015-5333", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "name": "USN-2558-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "name": "FEDORA-2015-5216", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "name": "[Mailman-Developers] 20150327 Security patch and Mailman 2.1.20 to be released on 31 March", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "name": "[Mailman-Announce] 20150327 Mailman 2.1.20 release", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "name": "[Mailman-Developers] 20150331 Security patch and Mailman 2.1.20 to be released on 31 March", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "name": "1032033", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032033" }, { "name": "73922", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/73922" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2015-03-27T00:00:00", "descriptions": [ { "lang": "en", "value": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2016-12-22T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "name": "DSA-3214", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2015/dsa-3214" }, { "name": "RHSA-2015:1153", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "name": "RHSA-2015:1417", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "name": "FEDORA-2015-5333", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "name": "USN-2558-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "name": "FEDORA-2015-5216", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "name": "[Mailman-Developers] 20150327 Security patch and Mailman 2.1.20 to be released on 31 March", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "name": "[Mailman-Announce] 20150327 Mailman 2.1.20 release", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "name": "[Mailman-Developers] 20150331 Security patch and Mailman 2.1.20 to be released on 31 March", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "name": "1032033", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1032033" }, { "name": "73922", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/73922" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-2775", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugs.launchpad.net/mailman/+bug/1437145", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "name": "DSA-3214", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3214" }, { "name": "RHSA-2015:1153", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "name": "RHSA-2015:1417", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "name": "FEDORA-2015-5333", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "name": "USN-2558-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "name": "FEDORA-2015-5216", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "name": "[Mailman-Developers] 20150327 Security patch and Mailman 2.1.20 to be released on 31 March", "refsource": "MLIST", "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "name": "[Mailman-Announce] 20150327 Mailman 2.1.20 release", "refsource": "MLIST", "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "name": "[Mailman-Developers] 20150331 Security patch and Mailman 2.1.20 to be released on 31 March", "refsource": "MLIST", "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "name": "1032033", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1032033" }, { "name": "73922", "refsource": "BID", "url": "http://www.securityfocus.com/bid/73922" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-2775", "datePublished": "2015-04-13T14:00:00", "dateReserved": "2015-03-27T00:00:00", "dateUpdated": "2024-08-06T05:24:38.852Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2015-2775\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2015-04-13T14:59:02.397\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de salto de directorio en GNU Mailman anterior a 2.1.20, cuando no utiliza un alias est\u00e1tico, permite a atacantes remotos ejecutar ficheros arbitrarios a trav\u00e9s de un .. (punto punto) en un nombre de lista.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:N/C:C/I:C/A:C\",\"baseScore\":7.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":4.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49A63F39-30BE-443F-AF10-6245587D3359\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.1.19\",\"matchCriteriaId\":\"D12BCF8B-CA13-4A87-9498-C01C4F58980F\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1153.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1417.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3214\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/73922\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1032033\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2558-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.launchpad.net/mailman/+bug/1437145\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1153.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-1417.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3214\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/73922\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1032033\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2558-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.launchpad.net/mailman/+bug/1437145\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]}]}}" } }
suse-su-2019:13924-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for mailman", "title": "Title of the patch" }, { "category": "description", "text": "This update for mailman fixes the following issues:\n\n- Fixed a XSS vulnerability and information leak in user options CGI, which\n could be used to execute arbitrary scripts in the user\u0027s browser via\n specially encoded URLs (bsc#1077358 CVE-2018-5950)\n- Fixed a directory traversal vulnerability in MTA transports when using the\n recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)\n- Fixed a XSS vulnerability, which allowed malicious listowners to inject\n scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)\n- Fixed arbitrary text injection vulnerability in several mailman CGIs\n (CVE-2018-13796 bsc#1101288)\n- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)\n", "title": "Description of the patch" }, { "category": "details", "text": "sleposp3-mailman-13924,slessp3-mailman-13924,slessp4-mailman-13924", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_13924-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2019:13924-1", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201913924-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2019:13924-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-January/005015.html" }, { "category": "self", "summary": "SUSE Bug 1077358", "url": "https://bugzilla.suse.com/1077358" }, { "category": "self", "summary": "SUSE Bug 1099510", "url": "https://bugzilla.suse.com/1099510" }, { "category": "self", "summary": "SUSE Bug 1101288", "url": "https://bugzilla.suse.com/1101288" }, { "category": "self", "summary": "SUSE Bug 925502", "url": "https://bugzilla.suse.com/925502" }, { "category": "self", "summary": "SUSE Bug 995352", "url": "https://bugzilla.suse.com/995352" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2775 page", "url": "https://www.suse.com/security/cve/CVE-2015-2775/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6893 page", "url": "https://www.suse.com/security/cve/CVE-2016-6893/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-0618 page", "url": "https://www.suse.com/security/cve/CVE-2018-0618/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-13796 page", "url": "https://www.suse.com/security/cve/CVE-2018-13796/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5950 page", "url": "https://www.suse.com/security/cve/CVE-2018-5950/" } ], "title": "Security update for mailman", "tracking": { "current_release_date": "2019-01-04T10:03:11Z", "generator": { "date": "2019-01-04T10:03:11Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2019:13924-1", "initial_release_date": "2019-01-04T10:03:11Z", "revision_history": [ { "date": "2019-01-04T10:03:11Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "mailman-2.1.15-9.6.6.1.i586", "product": { "name": "mailman-2.1.15-9.6.6.1.i586", "product_id": "mailman-2.1.15-9.6.6.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.15-9.6.6.1.ia64", "product": { "name": "mailman-2.1.15-9.6.6.1.ia64", "product_id": "mailman-2.1.15-9.6.6.1.ia64" } } ], "category": "architecture", "name": "ia64" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.15-9.6.6.1.ppc64", "product": { "name": "mailman-2.1.15-9.6.6.1.ppc64", "product_id": "mailman-2.1.15-9.6.6.1.ppc64" } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.15-9.6.6.1.s390x", "product": { "name": "mailman-2.1.15-9.6.6.1.s390x", "product_id": "mailman-2.1.15-9.6.6.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.15-9.6.6.1.x86_64", "product": { "name": "mailman-2.1.15-9.6.6.1.x86_64", "product_id": "mailman-2.1.15-9.6.6.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Point of Sale 11 SP3", "product": { "name": "SUSE Linux Enterprise Point of Sale 11 SP3", "product_id": "SUSE Linux Enterprise Point of Sale 11 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-pos:11:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 11 SP3-LTSS", "product": { "name": "SUSE Linux Enterprise Server 11 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_sles_ltss:11:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 11 SP3-TERADATA", "product": { "name": "SUSE Linux Enterprise Server 11 SP3-TERADATA", "product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:11:sp3:teradata" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 11 SP4", "product": { "name": "SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_sles:11:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:11:sp4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Point of Sale 11 SP3", "product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586" }, "product_reference": "mailman-2.1.15-9.6.6.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586" }, "product_reference": "mailman-2.1.15-9.6.6.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x" }, "product_reference": "mailman-2.1.15-9.6.6.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64" }, "product_reference": "mailman-2.1.15-9.6.6.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA", "product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586" }, "product_reference": "mailman-2.1.15-9.6.6.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-TERADATA", "product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x" }, "product_reference": "mailman-2.1.15-9.6.6.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA", "product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64" }, "product_reference": "mailman-2.1.15-9.6.6.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586" }, "product_reference": "mailman-2.1.15-9.6.6.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64" }, "product_reference": "mailman-2.1.15-9.6.6.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64" }, "product_reference": "mailman-2.1.15-9.6.6.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x" }, "product_reference": "mailman-2.1.15-9.6.6.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" }, "product_reference": "mailman-2.1.15-9.6.6.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586" }, "product_reference": "mailman-2.1.15-9.6.6.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64" }, "product_reference": "mailman-2.1.15-9.6.6.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64" }, "product_reference": "mailman-2.1.15-9.6.6.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x" }, "product_reference": "mailman-2.1.15-9.6.6.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" }, "product_reference": "mailman-2.1.15-9.6.6.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-2775", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2775" } ], "notes": [ { "category": "general", "text": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2775", "url": "https://www.suse.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "SUSE Bug 925502 for CVE-2015-2775", "url": "https://bugzilla.suse.com/925502" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-01-04T10:03:11Z", "details": "moderate" } ], "title": "CVE-2015-2775" }, { "cve": "CVE-2016-6893", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6893" } ], "notes": [ { "category": "general", "text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6893", "url": "https://www.suse.com/security/cve/CVE-2016-6893" }, { "category": "external", "summary": "SUSE Bug 995352 for CVE-2016-6893", "url": "https://bugzilla.suse.com/995352" }, { "category": "external", "summary": "SUSE Bug 997205 for CVE-2016-6893", "url": "https://bugzilla.suse.com/997205" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-01-04T10:03:11Z", "details": "low" } ], "title": "CVE-2016-6893" }, { "cve": "CVE-2018-0618", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-0618" } ], "notes": [ { "category": "general", "text": "Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-0618", "url": "https://www.suse.com/security/cve/CVE-2018-0618" }, { "category": "external", "summary": "SUSE Bug 1099510 for CVE-2018-0618", "url": "https://bugzilla.suse.com/1099510" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-01-04T10:03:11Z", "details": "moderate" } ], "title": "CVE-2018-0618" }, { "cve": "CVE-2018-13796", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-13796" } ], "notes": [ { "category": "general", "text": "An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-13796", "url": "https://www.suse.com/security/cve/CVE-2018-13796" }, { "category": "external", "summary": "SUSE Bug 1101288 for CVE-2018-13796", "url": "https://bugzilla.suse.com/1101288" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-01-04T10:03:11Z", "details": "moderate" } ], "title": "CVE-2018-13796" }, { "cve": "CVE-2018-5950", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5950" } ], "notes": [ { "category": "general", "text": "Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5950", "url": "https://www.suse.com/security/cve/CVE-2018-5950" }, { "category": "external", "summary": "SUSE Bug 1077358 for CVE-2018-5950", "url": "https://bugzilla.suse.com/1077358" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-01-04T10:03:11Z", "details": "moderate" } ], "title": "CVE-2018-5950" } ] }
suse-su-2018:4296-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for mailman", "title": "Title of the patch" }, { "category": "description", "text": "This update for mailman fixes the following security vulnerabilities:\n\n- Fixed a XSS vulnerability and information leak in user options CGI, which\n could be used to execute arbitrary scripts in the user\u0027s browser via\n specially encoded URLs (bsc#1077358 CVE-2018-5950)\n- Fixed a directory traversal vulnerability in MTA transports when using the\n recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)\n- Fixed a XSS vulnerability, which allowed malicious listowners to inject\n scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)\n- Fixed arbitrary text injection vulnerability in several mailman CGIs\n (CVE-2018-13796 bsc#1101288)\n- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-OpenStack-Cloud-7-2018-3062,SUSE-SLE-SAP-12-SP1-2018-3062,SUSE-SLE-SAP-12-SP2-2018-3062,SUSE-SLE-SERVER-12-2018-3062,SUSE-SLE-SERVER-12-SP1-2018-3062,SUSE-SLE-SERVER-12-SP2-2018-3062,SUSE-SLE-SERVER-12-SP2-BCL-2018-3062,SUSE-SLE-SERVER-12-SP3-2018-3062,SUSE-SLE-SERVER-12-SP4-2018-3062,SUSE-Storage-4-2018-3062", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_4296-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:4296-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184296-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:4296-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-December/005005.html" }, { "category": "self", "summary": "SUSE Bug 1077358", "url": "https://bugzilla.suse.com/1077358" }, { "category": "self", "summary": "SUSE Bug 1099510", "url": "https://bugzilla.suse.com/1099510" }, { "category": "self", "summary": "SUSE Bug 1101288", "url": "https://bugzilla.suse.com/1101288" }, { "category": "self", "summary": "SUSE Bug 925502", "url": "https://bugzilla.suse.com/925502" }, { "category": "self", "summary": "SUSE Bug 995352", "url": "https://bugzilla.suse.com/995352" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2775 page", "url": "https://www.suse.com/security/cve/CVE-2015-2775/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6893 page", "url": "https://www.suse.com/security/cve/CVE-2016-6893/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-0618 page", "url": "https://www.suse.com/security/cve/CVE-2018-0618/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-13796 page", "url": "https://www.suse.com/security/cve/CVE-2018-13796/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5950 page", "url": "https://www.suse.com/security/cve/CVE-2018-5950/" } ], "title": "Security update for mailman", "tracking": { "current_release_date": "2018-12-28T17:38:42Z", "generator": { "date": "2018-12-28T17:38:42Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:4296-1", "initial_release_date": "2018-12-28T17:38:42Z", "revision_history": [ { "date": "2018-12-28T17:38:42Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "mailman-2.1.17-3.3.3.ppc64le", "product": { "name": "mailman-2.1.17-3.3.3.ppc64le", "product_id": "mailman-2.1.17-3.3.3.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.17-3.3.3.s390x", "product": { "name": "mailman-2.1.17-3.3.3.s390x", "product_id": "mailman-2.1.17-3.3.3.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.17-3.3.3.x86_64", "product": { "name": "mailman-2.1.17-3.3.3.x86_64", "product_id": "mailman-2.1.17-3.3.3.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE OpenStack Cloud 7", "product": { "name": "SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud:7" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12-LTSS", "product": { "name": "SUSE Linux Enterprise Server 12-LTSS", "product_id": "SUSE Linux Enterprise Server 12-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-ltss:12" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP1-LTSS", "product": { "name": "SUSE Linux Enterprise Server 12 SP1-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-ltss:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP2-LTSS", "product": { "name": "SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-ltss:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP2-BCL", "product": { "name": "SUSE Linux Enterprise Server 12 SP2-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-bcl:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP3", "product": { "name": "SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP4", "product": { "name": "SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp4" } } }, { "category": "product_name", "name": "SUSE Enterprise Storage 4", "product": { "name": "SUSE Enterprise Storage 4", "product_id": "SUSE Enterprise Storage 4", "product_identification_helper": { "cpe": "cpe:/o:suse:ses:4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS", "product_id": "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12-LTSS", "product_id": "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS", "product_id": "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le" }, "product_reference": "mailman-2.1.17-3.3.3.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x" }, "product_reference": "mailman-2.1.17-3.3.3.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Enterprise Storage 4", "product_id": "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64" }, "product_reference": "mailman-2.1.17-3.3.3.x86_64", "relates_to_product_reference": "SUSE Enterprise Storage 4" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-2775", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2775" } ], "notes": [ { "category": "general", "text": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2775", "url": "https://www.suse.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "SUSE Bug 925502 for CVE-2015-2775", "url": "https://bugzilla.suse.com/925502" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-28T17:38:42Z", "details": "moderate" } ], "title": "CVE-2015-2775" }, { "cve": "CVE-2016-6893", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6893" } ], "notes": [ { "category": "general", "text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6893", "url": "https://www.suse.com/security/cve/CVE-2016-6893" }, { "category": "external", "summary": "SUSE Bug 995352 for CVE-2016-6893", "url": "https://bugzilla.suse.com/995352" }, { "category": "external", "summary": "SUSE Bug 997205 for CVE-2016-6893", "url": "https://bugzilla.suse.com/997205" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-28T17:38:42Z", "details": "low" } ], "title": "CVE-2016-6893" }, { "cve": "CVE-2018-0618", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-0618" } ], "notes": [ { "category": "general", "text": "Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-0618", "url": "https://www.suse.com/security/cve/CVE-2018-0618" }, { "category": "external", "summary": "SUSE Bug 1099510 for CVE-2018-0618", "url": "https://bugzilla.suse.com/1099510" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-28T17:38:42Z", "details": "moderate" } ], "title": "CVE-2018-0618" }, { "cve": "CVE-2018-13796", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-13796" } ], "notes": [ { "category": "general", "text": "An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-13796", "url": "https://www.suse.com/security/cve/CVE-2018-13796" }, { "category": "external", "summary": "SUSE Bug 1101288 for CVE-2018-13796", "url": "https://bugzilla.suse.com/1101288" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-28T17:38:42Z", "details": "moderate" } ], "title": "CVE-2018-13796" }, { "cve": "CVE-2018-5950", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5950" } ], "notes": [ { "category": "general", "text": "Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5950", "url": "https://www.suse.com/security/cve/CVE-2018-5950" }, { "category": "external", "summary": "SUSE Bug 1077358 for CVE-2018-5950", "url": "https://bugzilla.suse.com/1077358" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x", "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-28T17:38:42Z", "details": "moderate" } ], "title": "CVE-2018-5950" } ] }
RHSA-2015:1417
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated mailman packages that fix two security issues and several bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Mailman is a program used to help manage e-mail discussion lists.\n\nIt was found that mailman did not sanitize the list name before passing it\nto certain MTAs. A local attacker could use this flaw to execute arbitrary\ncode as the user running mailman. (CVE-2015-2775)\n\nIt was found that mailman stored private email messages in a world-readable\ndirectory. A local user could use this flaw to read private mailing list\narchives. (CVE-2002-0389)\n\nThis update also fixes the following bugs:\n\n* Previously, it was impossible to configure Mailman in a way that\nDomain-based Message Authentication, Reporting \u0026 Conformance (DMARC) would\nrecognize Sender alignment for Domain Key Identified Mail (DKIM)\nsignatures. Consequently, Mailman list subscribers that belonged to a mail\nserver with a \"reject\" policy for DMARC, such as yahoo.com or AOL.com, were\nunable to receive Mailman forwarded messages from senders residing in any\ndomain that provided DKIM signatures. With this update, domains with a\n\"reject\" DMARC policy are recognized correctly, and Mailman list\nadministrators are able to configure the way these messages are handled.\nAs a result, after a proper configuration, subscribers now correctly\nreceive Mailman forwarded messages in this scenario. (BZ#1095359)\n\n* Mailman used a console encoding when generating a subject for a \"welcome\nemail\" when new mailing lists were created by the \"newlist\" command.\nConsequently, when the console encoding did not match the encoding used by\nMailman for that particular language, characters in the \"welcome email\"\ncould be displayed incorrectly. Mailman has been fixed to use the correct\nencoding, and characters in the \"welcome email\" are now displayed properly.\n(BZ#1056366)\n\n* The \"rmlist\" command used a hardcoded path to list data based on the\nVAR_PREFIX configuration variable. As a consequence, when the list was\ncreated outside of VAR_PREFIX, it was impossible to remove it using the\n\"rmlist\" command. With this update, the \"rmlist\" command uses the correct\nLIST_DATA_DIR value instead of VAR_PREFIX, and it is now possible to remove\nthe list in described situation. (BZ#1008139)\n\n* Due to an incompatibility between Python and Mailman in Red Hat\nEnterprise Linux 6, when moderators were approving a moderated message to a\nmailing list and checked the \"Preserve messages for the site administrator\"\ncheckbox, Mailman failed to approve the message and returned an error.\nThis incompatibility has been fixed, and Mailman now approves messages as\nexpected in this scenario. (BZ#765807)\n\n* When Mailman was set to not archive a list but the archive was not set to\nprivate, attachments sent to that list were placed in a public archive.\nConsequently, users of Mailman web interface could list private attachments\nbecause httpd configuration of public archive directory allows listing all\nfiles in the archive directory. The httpd configuration of Mailman has been\nfixed to not allow listing of private archive directory, and users of\nMailman web interface are no longer able to list private attachments.\n(BZ#745409)\n\nUsers of mailman are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:1417", "url": "https://access.redhat.com/errata/RHSA-2015:1417" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "723584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=723584" }, { "category": "external", "summary": "745409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=745409" }, { "category": "external", "summary": "765807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=765807" }, { "category": "external", "summary": "1008139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1008139" }, { "category": "external", "summary": "1056366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1056366" }, { "category": "external", "summary": "1095359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095359" }, { "category": "external", "summary": "1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1417.json" } ], "title": "Red Hat Security Advisory: mailman security and bug fix update", "tracking": { "current_release_date": "2025-09-10T14:07:47+00:00", "generator": { "date": "2025-09-10T14:07:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.7" } }, "id": "RHSA-2015:1417", "initial_release_date": "2015-07-20T14:06:40+00:00", "revision_history": [ { "date": "2015-07-20T14:06:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2015-07-20T14:06:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-10T14:07:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.src", "product": { "name": "mailman-3:2.1.12-25.el6.src", "product_id": "mailman-3:2.1.12-25.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=src\u0026epoch=3" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.x86_64", "product": { "name": "mailman-3:2.1.12-25.el6.x86_64", "product_id": "mailman-3:2.1.12-25.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=x86_64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=x86_64\u0026epoch=3" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.i686", "product": { "name": "mailman-3:2.1.12-25.el6.i686", "product_id": "mailman-3:2.1.12-25.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=i686\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=i686\u0026epoch=3" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=s390x\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.s390x", "product": { "name": "mailman-3:2.1.12-25.el6.s390x", "product_id": "mailman-3:2.1.12-25.el6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=s390x\u0026epoch=3" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.ppc64", "product": { "name": "mailman-3:2.1.12-25.el6.ppc64", "product_id": "mailman-3:2.1.12-25.el6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=ppc64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=ppc64\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.src" }, "product_reference": "mailman-3:2.1.12-25.el6.src", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.src" }, "product_reference": "mailman-3:2.1.12-25.el6.src", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Workstation" } ] }, "vulnerabilities": [ { "cve": "CVE-2002-0389", "discovery_date": "2011-06-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "723584" } ], "notes": [ { "category": "description", "text": "It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: Local users able to read private mailing list archives", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2002-0389" }, { "category": "external", "summary": "RHBZ#723584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=723584" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0389", "url": "https://www.cve.org/CVERecord?id=CVE-2002-0389" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0389", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0389" } ], "release_date": "2008-08-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-07-20T14:06:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1417" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "mailman: Local users able to read private mailing list archives" }, { "cve": "CVE-2015-2775", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2015-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1208059" } ], "notes": [ { "category": "description", "text": "It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: directory traversal in MTA transports that deliver programmatically", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "RHBZ#1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" } ], "release_date": "2015-03-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-07-20T14:06:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1417" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mailman: directory traversal in MTA transports that deliver programmatically" } ] }
rhsa-2015_1417
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated mailman packages that fix two security issues and several bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Mailman is a program used to help manage e-mail discussion lists.\n\nIt was found that mailman did not sanitize the list name before passing it\nto certain MTAs. A local attacker could use this flaw to execute arbitrary\ncode as the user running mailman. (CVE-2015-2775)\n\nIt was found that mailman stored private email messages in a world-readable\ndirectory. A local user could use this flaw to read private mailing list\narchives. (CVE-2002-0389)\n\nThis update also fixes the following bugs:\n\n* Previously, it was impossible to configure Mailman in a way that\nDomain-based Message Authentication, Reporting \u0026 Conformance (DMARC) would\nrecognize Sender alignment for Domain Key Identified Mail (DKIM)\nsignatures. Consequently, Mailman list subscribers that belonged to a mail\nserver with a \"reject\" policy for DMARC, such as yahoo.com or AOL.com, were\nunable to receive Mailman forwarded messages from senders residing in any\ndomain that provided DKIM signatures. With this update, domains with a\n\"reject\" DMARC policy are recognized correctly, and Mailman list\nadministrators are able to configure the way these messages are handled.\nAs a result, after a proper configuration, subscribers now correctly\nreceive Mailman forwarded messages in this scenario. (BZ#1095359)\n\n* Mailman used a console encoding when generating a subject for a \"welcome\nemail\" when new mailing lists were created by the \"newlist\" command.\nConsequently, when the console encoding did not match the encoding used by\nMailman for that particular language, characters in the \"welcome email\"\ncould be displayed incorrectly. Mailman has been fixed to use the correct\nencoding, and characters in the \"welcome email\" are now displayed properly.\n(BZ#1056366)\n\n* The \"rmlist\" command used a hardcoded path to list data based on the\nVAR_PREFIX configuration variable. As a consequence, when the list was\ncreated outside of VAR_PREFIX, it was impossible to remove it using the\n\"rmlist\" command. With this update, the \"rmlist\" command uses the correct\nLIST_DATA_DIR value instead of VAR_PREFIX, and it is now possible to remove\nthe list in described situation. (BZ#1008139)\n\n* Due to an incompatibility between Python and Mailman in Red Hat\nEnterprise Linux 6, when moderators were approving a moderated message to a\nmailing list and checked the \"Preserve messages for the site administrator\"\ncheckbox, Mailman failed to approve the message and returned an error.\nThis incompatibility has been fixed, and Mailman now approves messages as\nexpected in this scenario. (BZ#765807)\n\n* When Mailman was set to not archive a list but the archive was not set to\nprivate, attachments sent to that list were placed in a public archive.\nConsequently, users of Mailman web interface could list private attachments\nbecause httpd configuration of public archive directory allows listing all\nfiles in the archive directory. The httpd configuration of Mailman has been\nfixed to not allow listing of private archive directory, and users of\nMailman web interface are no longer able to list private attachments.\n(BZ#745409)\n\nUsers of mailman are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:1417", "url": "https://access.redhat.com/errata/RHSA-2015:1417" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "723584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=723584" }, { "category": "external", "summary": "745409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=745409" }, { "category": "external", "summary": "765807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=765807" }, { "category": "external", "summary": "1008139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1008139" }, { "category": "external", "summary": "1056366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1056366" }, { "category": "external", "summary": "1095359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095359" }, { "category": "external", "summary": "1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1417.json" } ], "title": "Red Hat Security Advisory: mailman security and bug fix update", "tracking": { "current_release_date": "2024-11-22T09:00:56+00:00", "generator": { "date": "2024-11-22T09:00:56+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2015:1417", "initial_release_date": "2015-07-20T14:06:40+00:00", "revision_history": [ { "date": "2015-07-20T14:06:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2015-07-20T14:06:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T09:00:56+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.src", "product": { "name": "mailman-3:2.1.12-25.el6.src", "product_id": "mailman-3:2.1.12-25.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=src\u0026epoch=3" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.x86_64", "product": { "name": "mailman-3:2.1.12-25.el6.x86_64", "product_id": "mailman-3:2.1.12-25.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=x86_64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=x86_64\u0026epoch=3" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.i686", "product": { "name": "mailman-3:2.1.12-25.el6.i686", "product_id": "mailman-3:2.1.12-25.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=i686\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=i686\u0026epoch=3" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=s390x\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.s390x", "product": { "name": "mailman-3:2.1.12-25.el6.s390x", "product_id": "mailman-3:2.1.12-25.el6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=s390x\u0026epoch=3" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.ppc64", "product": { "name": "mailman-3:2.1.12-25.el6.ppc64", "product_id": "mailman-3:2.1.12-25.el6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=ppc64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=ppc64\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.src" }, "product_reference": "mailman-3:2.1.12-25.el6.src", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.src" }, "product_reference": "mailman-3:2.1.12-25.el6.src", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Workstation" } ] }, "vulnerabilities": [ { "cve": "CVE-2002-0389", "discovery_date": "2011-06-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "723584" } ], "notes": [ { "category": "description", "text": "It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: Local users able to read private mailing list archives", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2002-0389" }, { "category": "external", "summary": "RHBZ#723584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=723584" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0389", "url": "https://www.cve.org/CVERecord?id=CVE-2002-0389" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0389", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0389" } ], "release_date": "2008-08-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-07-20T14:06:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1417" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "mailman: Local users able to read private mailing list archives" }, { "cve": "CVE-2015-2775", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2015-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1208059" } ], "notes": [ { "category": "description", "text": "It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: directory traversal in MTA transports that deliver programmatically", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "RHBZ#1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" } ], "release_date": "2015-03-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-07-20T14:06:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1417" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mailman: directory traversal in MTA transports that deliver programmatically" } ] }
rhsa-2015_1153
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated mailman packages that fix one security issue and several bugs are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.", "title": "Topic" }, { "category": "general", "text": "Mailman is a program used to help manage email discussion lists.\n\nIt was found that mailman did not sanitize the list name before passing it\nto certain MTAs. A local attacker could use this flaw to execute arbitrary\ncode as the user running mailman. (CVE-2015-2775)\n\nThis update also fixes the following bugs:\n\n* Previously, it was impossible to configure Mailman in a way that\nDomain-based Message Authentication, Reporting \u0026 Conformance (DMARC) would\nrecognize Sender alignment for Domain Key Identified Mail (DKIM)\nsignatures. Consequently, Mailman list subscribers that belonged to a mail\nserver with a \"reject\" policy for DMARC, such as yahoo.com or AOL.com, were\nunable to receive Mailman forwarded messages from senders residing in any\ndomain that provided DKIM signatures. With this update, domains with a\n\"reject\" DMARC policy are recognized correctly, and Mailman list\nadministrators are able to configure the way these messages are handled. As\na result, after a proper configuration, subscribers now correctly receive\nMailman forwarded messages in this scenario. (BZ#1229288)\n\n* Previously, the /etc/mailman file had incorrectly set permissions, which\nin some cases caused removing Mailman lists to fail with a \"\u0027NoneType\u0027\nobject has no attribute \u0027close\u0027\" message. With this update, the permissions\nvalue for /etc/mailman is correctly set to 2775 instead of 0755, and\nremoving Mailman lists now works as expected. (BZ#1229307)\n\n* Prior to this update, the mailman utility incorrectly installed the\ntmpfiles configuration in the /etc/tmpfiles.d/ directory. As a consequence,\nchanges made to mailman tmpfiles configuration were overwritten if the\nmailman packages were reinstalled or updated. The mailman utility now\ninstalls the tmpfiles configuration in the /usr/lib/tmpfiles.d/ directory,\nand changes made to them by the user are preserved on reinstall or update.\n(BZ#1229306)\n\nAll mailman users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:1153", "url": "https://access.redhat.com/errata/RHSA-2015:1153" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "1229288", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229288" }, { "category": "external", "summary": "1229307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229307" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1153.json" } ], "title": "Red Hat Security Advisory: mailman security and bug fix update", "tracking": { "current_release_date": "2024-11-22T09:01:02+00:00", "generator": { "date": "2024-11-22T09:01:02+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2015:1153", "initial_release_date": "2015-06-23T09:11:39+00:00", "revision_history": [ { "date": "2015-06-23T09:11:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2015-06-23T09:11:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T09:01:02+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product": { "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product_id": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.ael7b_1?arch=ppc64le\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product": { "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product_id": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.ael7b_1?arch=ppc64le\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.15-21.ael7b_1.src", "product": { "name": "mailman-3:2.1.15-21.ael7b_1.src", "product_id": "mailman-3:2.1.15-21.ael7b_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.ael7b_1?arch=src\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.src", "product": { "name": "mailman-3:2.1.15-21.el7_1.src", "product_id": "mailman-3:2.1.15-21.el7_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=src\u0026epoch=3" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=s390x\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.s390x", "product": { "name": "mailman-3:2.1.15-21.el7_1.s390x", "product_id": "mailman-3:2.1.15-21.el7_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=s390x\u0026epoch=3" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=x86_64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.x86_64", "product": { "name": "mailman-3:2.1.15-21.el7_1.x86_64", "product_id": "mailman-3:2.1.15-21.el7_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=x86_64\u0026epoch=3" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=ppc64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.ppc64", "product": { "name": "mailman-3:2.1.15-21.el7_1.ppc64", "product_id": "mailman-3:2.1.15-21.el7_1.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=ppc64\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src" }, "product_reference": "mailman-3:2.1.15-21.el7_1.src", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le" }, "product_reference": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.ael7b_1.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src" }, "product_reference": "mailman-3:2.1.15-21.ael7b_1.src", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src" }, "product_reference": "mailman-3:2.1.15-21.el7_1.src", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Workstation-7.1.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-2775", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2015-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1208059" } ], "notes": [ { "category": "description", "text": "It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: directory traversal in MTA transports that deliver programmatically", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "RHBZ#1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" } ], "release_date": "2015-03-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-06-23T09:11:39+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1153" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mailman: directory traversal in MTA transports that deliver programmatically" } ] }
rhsa-2015:1153
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated mailman packages that fix one security issue and several bugs are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.", "title": "Topic" }, { "category": "general", "text": "Mailman is a program used to help manage email discussion lists.\n\nIt was found that mailman did not sanitize the list name before passing it\nto certain MTAs. A local attacker could use this flaw to execute arbitrary\ncode as the user running mailman. (CVE-2015-2775)\n\nThis update also fixes the following bugs:\n\n* Previously, it was impossible to configure Mailman in a way that\nDomain-based Message Authentication, Reporting \u0026 Conformance (DMARC) would\nrecognize Sender alignment for Domain Key Identified Mail (DKIM)\nsignatures. Consequently, Mailman list subscribers that belonged to a mail\nserver with a \"reject\" policy for DMARC, such as yahoo.com or AOL.com, were\nunable to receive Mailman forwarded messages from senders residing in any\ndomain that provided DKIM signatures. With this update, domains with a\n\"reject\" DMARC policy are recognized correctly, and Mailman list\nadministrators are able to configure the way these messages are handled. As\na result, after a proper configuration, subscribers now correctly receive\nMailman forwarded messages in this scenario. (BZ#1229288)\n\n* Previously, the /etc/mailman file had incorrectly set permissions, which\nin some cases caused removing Mailman lists to fail with a \"\u0027NoneType\u0027\nobject has no attribute \u0027close\u0027\" message. With this update, the permissions\nvalue for /etc/mailman is correctly set to 2775 instead of 0755, and\nremoving Mailman lists now works as expected. (BZ#1229307)\n\n* Prior to this update, the mailman utility incorrectly installed the\ntmpfiles configuration in the /etc/tmpfiles.d/ directory. As a consequence,\nchanges made to mailman tmpfiles configuration were overwritten if the\nmailman packages were reinstalled or updated. The mailman utility now\ninstalls the tmpfiles configuration in the /usr/lib/tmpfiles.d/ directory,\nand changes made to them by the user are preserved on reinstall or update.\n(BZ#1229306)\n\nAll mailman users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:1153", "url": "https://access.redhat.com/errata/RHSA-2015:1153" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "1229288", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229288" }, { "category": "external", "summary": "1229307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229307" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1153.json" } ], "title": "Red Hat Security Advisory: mailman security and bug fix update", "tracking": { "current_release_date": "2025-09-10T14:07:22+00:00", "generator": { "date": "2025-09-10T14:07:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.7" } }, "id": "RHSA-2015:1153", "initial_release_date": "2015-06-23T09:11:39+00:00", "revision_history": [ { "date": "2015-06-23T09:11:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2015-06-23T09:11:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-10T14:07:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product": { "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product_id": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.ael7b_1?arch=ppc64le\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product": { "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product_id": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.ael7b_1?arch=ppc64le\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.15-21.ael7b_1.src", "product": { "name": "mailman-3:2.1.15-21.ael7b_1.src", "product_id": "mailman-3:2.1.15-21.ael7b_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.ael7b_1?arch=src\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.src", "product": { "name": "mailman-3:2.1.15-21.el7_1.src", "product_id": "mailman-3:2.1.15-21.el7_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=src\u0026epoch=3" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=s390x\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.s390x", "product": { "name": "mailman-3:2.1.15-21.el7_1.s390x", "product_id": "mailman-3:2.1.15-21.el7_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=s390x\u0026epoch=3" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=x86_64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.x86_64", "product": { "name": "mailman-3:2.1.15-21.el7_1.x86_64", "product_id": "mailman-3:2.1.15-21.el7_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=x86_64\u0026epoch=3" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=ppc64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.ppc64", "product": { "name": "mailman-3:2.1.15-21.el7_1.ppc64", "product_id": "mailman-3:2.1.15-21.el7_1.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=ppc64\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src" }, "product_reference": "mailman-3:2.1.15-21.el7_1.src", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le" }, "product_reference": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.ael7b_1.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src" }, "product_reference": "mailman-3:2.1.15-21.ael7b_1.src", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src" }, "product_reference": "mailman-3:2.1.15-21.el7_1.src", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Workstation-7.1.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-2775", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2015-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1208059" } ], "notes": [ { "category": "description", "text": "It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: directory traversal in MTA transports that deliver programmatically", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "RHBZ#1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" } ], "release_date": "2015-03-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-06-23T09:11:39+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1153" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mailman: directory traversal in MTA transports that deliver programmatically" } ] }
rhsa-2015:1417
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated mailman packages that fix two security issues and several bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Mailman is a program used to help manage e-mail discussion lists.\n\nIt was found that mailman did not sanitize the list name before passing it\nto certain MTAs. A local attacker could use this flaw to execute arbitrary\ncode as the user running mailman. (CVE-2015-2775)\n\nIt was found that mailman stored private email messages in a world-readable\ndirectory. A local user could use this flaw to read private mailing list\narchives. (CVE-2002-0389)\n\nThis update also fixes the following bugs:\n\n* Previously, it was impossible to configure Mailman in a way that\nDomain-based Message Authentication, Reporting \u0026 Conformance (DMARC) would\nrecognize Sender alignment for Domain Key Identified Mail (DKIM)\nsignatures. Consequently, Mailman list subscribers that belonged to a mail\nserver with a \"reject\" policy for DMARC, such as yahoo.com or AOL.com, were\nunable to receive Mailman forwarded messages from senders residing in any\ndomain that provided DKIM signatures. With this update, domains with a\n\"reject\" DMARC policy are recognized correctly, and Mailman list\nadministrators are able to configure the way these messages are handled.\nAs a result, after a proper configuration, subscribers now correctly\nreceive Mailman forwarded messages in this scenario. (BZ#1095359)\n\n* Mailman used a console encoding when generating a subject for a \"welcome\nemail\" when new mailing lists were created by the \"newlist\" command.\nConsequently, when the console encoding did not match the encoding used by\nMailman for that particular language, characters in the \"welcome email\"\ncould be displayed incorrectly. Mailman has been fixed to use the correct\nencoding, and characters in the \"welcome email\" are now displayed properly.\n(BZ#1056366)\n\n* The \"rmlist\" command used a hardcoded path to list data based on the\nVAR_PREFIX configuration variable. As a consequence, when the list was\ncreated outside of VAR_PREFIX, it was impossible to remove it using the\n\"rmlist\" command. With this update, the \"rmlist\" command uses the correct\nLIST_DATA_DIR value instead of VAR_PREFIX, and it is now possible to remove\nthe list in described situation. (BZ#1008139)\n\n* Due to an incompatibility between Python and Mailman in Red Hat\nEnterprise Linux 6, when moderators were approving a moderated message to a\nmailing list and checked the \"Preserve messages for the site administrator\"\ncheckbox, Mailman failed to approve the message and returned an error.\nThis incompatibility has been fixed, and Mailman now approves messages as\nexpected in this scenario. (BZ#765807)\n\n* When Mailman was set to not archive a list but the archive was not set to\nprivate, attachments sent to that list were placed in a public archive.\nConsequently, users of Mailman web interface could list private attachments\nbecause httpd configuration of public archive directory allows listing all\nfiles in the archive directory. The httpd configuration of Mailman has been\nfixed to not allow listing of private archive directory, and users of\nMailman web interface are no longer able to list private attachments.\n(BZ#745409)\n\nUsers of mailman are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:1417", "url": "https://access.redhat.com/errata/RHSA-2015:1417" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "723584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=723584" }, { "category": "external", "summary": "745409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=745409" }, { "category": "external", "summary": "765807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=765807" }, { "category": "external", "summary": "1008139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1008139" }, { "category": "external", "summary": "1056366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1056366" }, { "category": "external", "summary": "1095359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095359" }, { "category": "external", "summary": "1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1417.json" } ], "title": "Red Hat Security Advisory: mailman security and bug fix update", "tracking": { "current_release_date": "2025-09-10T14:07:47+00:00", "generator": { "date": "2025-09-10T14:07:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.7" } }, "id": "RHSA-2015:1417", "initial_release_date": "2015-07-20T14:06:40+00:00", "revision_history": [ { "date": "2015-07-20T14:06:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2015-07-20T14:06:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-10T14:07:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.src", "product": { "name": "mailman-3:2.1.12-25.el6.src", "product_id": "mailman-3:2.1.12-25.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=src\u0026epoch=3" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.x86_64", "product": { "name": "mailman-3:2.1.12-25.el6.x86_64", "product_id": "mailman-3:2.1.12-25.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=x86_64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=x86_64\u0026epoch=3" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.i686", "product": { "name": "mailman-3:2.1.12-25.el6.i686", "product_id": "mailman-3:2.1.12-25.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=i686\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=i686\u0026epoch=3" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=s390x\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.s390x", "product": { "name": "mailman-3:2.1.12-25.el6.s390x", "product_id": "mailman-3:2.1.12-25.el6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=s390x\u0026epoch=3" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.12-25.el6.ppc64", "product": { "name": "mailman-3:2.1.12-25.el6.ppc64", "product_id": "mailman-3:2.1.12-25.el6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.12-25.el6?arch=ppc64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product_id": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.12-25.el6?arch=ppc64\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.src" }, "product_reference": "mailman-3:2.1.12-25.el6.src", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Server" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.src" }, "product_reference": "mailman-3:2.1.12-25.el6.src", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.i686", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.ppc64", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.s390x", "relates_to_product_reference": "6Workstation" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.12-25.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.12-25.el6.x86_64", "relates_to_product_reference": "6Workstation" } ] }, "vulnerabilities": [ { "cve": "CVE-2002-0389", "discovery_date": "2011-06-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "723584" } ], "notes": [ { "category": "description", "text": "It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: Local users able to read private mailing list archives", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2002-0389" }, { "category": "external", "summary": "RHBZ#723584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=723584" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0389", "url": "https://www.cve.org/CVERecord?id=CVE-2002-0389" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0389", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0389" } ], "release_date": "2008-08-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-07-20T14:06:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1417" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "mailman: Local users able to read private mailing list archives" }, { "cve": "CVE-2015-2775", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2015-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1208059" } ], "notes": [ { "category": "description", "text": "It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: directory traversal in MTA transports that deliver programmatically", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "RHBZ#1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" } ], "release_date": "2015-03-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-07-20T14:06:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1417" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server:mailman-3:2.1.12-25.el6.i686", "6Server:mailman-3:2.1.12-25.el6.ppc64", "6Server:mailman-3:2.1.12-25.el6.s390x", "6Server:mailman-3:2.1.12-25.el6.src", "6Server:mailman-3:2.1.12-25.el6.x86_64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Server:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Server:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Server:mailman-debuginfo-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-3:2.1.12-25.el6.i686", "6Workstation:mailman-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-3:2.1.12-25.el6.s390x", "6Workstation:mailman-3:2.1.12-25.el6.src", "6Workstation:mailman-3:2.1.12-25.el6.x86_64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.i686", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.ppc64", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.s390x", "6Workstation:mailman-debuginfo-3:2.1.12-25.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mailman: directory traversal in MTA transports that deliver programmatically" } ] }
RHSA-2015:1153
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated mailman packages that fix one security issue and several bugs are\nnow available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.", "title": "Topic" }, { "category": "general", "text": "Mailman is a program used to help manage email discussion lists.\n\nIt was found that mailman did not sanitize the list name before passing it\nto certain MTAs. A local attacker could use this flaw to execute arbitrary\ncode as the user running mailman. (CVE-2015-2775)\n\nThis update also fixes the following bugs:\n\n* Previously, it was impossible to configure Mailman in a way that\nDomain-based Message Authentication, Reporting \u0026 Conformance (DMARC) would\nrecognize Sender alignment for Domain Key Identified Mail (DKIM)\nsignatures. Consequently, Mailman list subscribers that belonged to a mail\nserver with a \"reject\" policy for DMARC, such as yahoo.com or AOL.com, were\nunable to receive Mailman forwarded messages from senders residing in any\ndomain that provided DKIM signatures. With this update, domains with a\n\"reject\" DMARC policy are recognized correctly, and Mailman list\nadministrators are able to configure the way these messages are handled. As\na result, after a proper configuration, subscribers now correctly receive\nMailman forwarded messages in this scenario. (BZ#1229288)\n\n* Previously, the /etc/mailman file had incorrectly set permissions, which\nin some cases caused removing Mailman lists to fail with a \"\u0027NoneType\u0027\nobject has no attribute \u0027close\u0027\" message. With this update, the permissions\nvalue for /etc/mailman is correctly set to 2775 instead of 0755, and\nremoving Mailman lists now works as expected. (BZ#1229307)\n\n* Prior to this update, the mailman utility incorrectly installed the\ntmpfiles configuration in the /etc/tmpfiles.d/ directory. As a consequence,\nchanges made to mailman tmpfiles configuration were overwritten if the\nmailman packages were reinstalled or updated. The mailman utility now\ninstalls the tmpfiles configuration in the /usr/lib/tmpfiles.d/ directory,\nand changes made to them by the user are preserved on reinstall or update.\n(BZ#1229306)\n\nAll mailman users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:1153", "url": "https://access.redhat.com/errata/RHSA-2015:1153" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "1229288", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229288" }, { "category": "external", "summary": "1229307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229307" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1153.json" } ], "title": "Red Hat Security Advisory: mailman security and bug fix update", "tracking": { "current_release_date": "2025-09-10T14:07:22+00:00", "generator": { "date": "2025-09-10T14:07:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.7" } }, "id": "RHSA-2015:1153", "initial_release_date": "2015-06-23T09:11:39+00:00", "revision_history": [ { "date": "2015-06-23T09:11:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2015-06-23T09:11:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-10T14:07:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product": { "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product_id": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.ael7b_1?arch=ppc64le\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product": { "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product_id": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.ael7b_1?arch=ppc64le\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "mailman-3:2.1.15-21.ael7b_1.src", "product": { "name": "mailman-3:2.1.15-21.ael7b_1.src", "product_id": "mailman-3:2.1.15-21.ael7b_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.ael7b_1?arch=src\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.src", "product": { "name": "mailman-3:2.1.15-21.el7_1.src", "product_id": "mailman-3:2.1.15-21.el7_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=src\u0026epoch=3" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=s390x\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.s390x", "product": { "name": "mailman-3:2.1.15-21.el7_1.s390x", "product_id": "mailman-3:2.1.15-21.el7_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=s390x\u0026epoch=3" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=x86_64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.x86_64", "product": { "name": "mailman-3:2.1.15-21.el7_1.x86_64", "product_id": "mailman-3:2.1.15-21.el7_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=x86_64\u0026epoch=3" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product_id": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-21.el7_1?arch=ppc64\u0026epoch=3" } } }, { "category": "product_version", "name": "mailman-3:2.1.15-21.el7_1.ppc64", "product": { "name": "mailman-3:2.1.15-21.el7_1.ppc64", "product_id": "mailman-3:2.1.15-21.el7_1.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/mailman@2.1.15-21.el7_1?arch=ppc64\u0026epoch=3" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src" }, "product_reference": "mailman-3:2.1.15-21.el7_1.src", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Server-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le" }, "product_reference": "mailman-3:2.1.15-21.ael7b_1.ppc64le", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.ael7b_1.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src" }, "product_reference": "mailman-3:2.1.15-21.ael7b_1.src", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "relates_to_product_reference": "7Server-LE-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src" }, "product_reference": "mailman-3:2.1.15-21.el7_1.src", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "relates_to_product_reference": "7Workstation-7.1.Z" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" }, "product_reference": "mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "relates_to_product_reference": "7Workstation-7.1.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-2775", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2015-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1208059" } ], "notes": [ { "category": "description", "text": "It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman.", "title": "Vulnerability description" }, { "category": "summary", "text": "mailman: directory traversal in MTA transports that deliver programmatically", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "RHBZ#1208059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" } ], "release_date": "2015-03-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-06-23T09:11:39+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:1153" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Server-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Server-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.ppc64le", "7Server-LE-7.1.Z:mailman-3:2.1.15-21.ael7b_1.src", "7Server-LE-7.1.Z:mailman-debuginfo-3:2.1.15-21.ael7b_1.ppc64le", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.src", "7Workstation-7.1.Z:mailman-3:2.1.15-21.el7_1.x86_64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.ppc64", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.s390x", "7Workstation-7.1.Z:mailman-debuginfo-3:2.1.15-21.el7_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mailman: directory traversal in MTA transports that deliver programmatically" } ] }
gsd-2015-2775
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2015-2775", "description": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.", "id": "GSD-2015-2775", "references": [ "https://www.suse.com/security/cve/CVE-2015-2775.html", "https://www.debian.org/security/2015/dsa-3214", "https://access.redhat.com/errata/RHSA-2015:1417", "https://access.redhat.com/errata/RHSA-2015:1153", "https://ubuntu.com/security/CVE-2015-2775", "https://advisories.mageia.org/CVE-2015-2775.html", "https://alas.aws.amazon.com/cve/html/CVE-2015-2775.html", "https://linux.oracle.com/cve/CVE-2015-2775.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2015-2775" ], "details": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.", "id": "GSD-2015-2775", "modified": "2023-12-13T01:20:00.116285Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-2775", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugs.launchpad.net/mailman/+bug/1437145", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "name": "DSA-3214", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3214" }, { "name": "RHSA-2015:1153", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "name": "RHSA-2015:1417", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "name": "FEDORA-2015-5333", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "name": "USN-2558-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "name": "FEDORA-2015-5216", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "name": "[Mailman-Developers] 20150327 Security patch and Mailman 2.1.20 to be released on 31 March", "refsource": "MLIST", "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "name": "[Mailman-Announce] 20150327 Mailman 2.1.20 release", "refsource": "MLIST", "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "name": "[Mailman-Developers] 20150331 Security patch and Mailman 2.1.20 to be released on 31 March", "refsource": "MLIST", "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "name": "1032033", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1032033" }, { "name": "73922", "refsource": "BID", "url": "http://www.securityfocus.com/bid/73922" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:gnu:mailman:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2.1.19", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-2775" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-22" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugs.launchpad.net/mailman/+bug/1437145", "refsource": "CONFIRM", "tags": [], "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "name": "DSA-3214", "refsource": "DEBIAN", "tags": [], "url": "http://www.debian.org/security/2015/dsa-3214" }, { "name": "[Mailman-Developers] 20150331 Security patch and Mailman 2.1.20 to be released on 31 March", "refsource": "MLIST", "tags": [ "Exploit" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "name": "[Mailman-Developers] 20150327 Security patch and Mailman 2.1.20 to be released on 31 March", "refsource": "MLIST", "tags": [ "Vendor Advisory" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "name": "USN-2558-1", "refsource": "UBUNTU", "tags": [], "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "name": "[Mailman-Announce] 20150327 Mailman 2.1.20 release", "refsource": "MLIST", "tags": [], "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "name": "1032033", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id/1032033" }, { "name": "RHSA-2015:1153", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "name": "73922", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/73922" }, { "name": "FEDORA-2015-5216", "refsource": "FEDORA", "tags": [], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "name": "FEDORA-2015-5333", "refsource": "FEDORA", "tags": [], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "name": "RHSA-2015:1417", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0" }, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false } }, "lastModifiedDate": "2016-12-24T02:59Z", "publishedDate": "2015-04-13T14:59Z" } } }
opensuse-su-2024:10215-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "mailman-2.1.23-1.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the mailman-2.1.23-1.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10215", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10215-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2011-0707 page", "url": "https://www.suse.com/security/cve/CVE-2011-0707/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2775 page", "url": "https://www.suse.com/security/cve/CVE-2015-2775/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6893 page", "url": "https://www.suse.com/security/cve/CVE-2016-6893/" } ], "title": "mailman-2.1.23-1.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10215-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "mailman-2.1.23-1.2.aarch64", "product": { "name": "mailman-2.1.23-1.2.aarch64", "product_id": "mailman-2.1.23-1.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.23-1.2.ppc64le", "product": { "name": "mailman-2.1.23-1.2.ppc64le", "product_id": "mailman-2.1.23-1.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.23-1.2.s390x", "product": { "name": "mailman-2.1.23-1.2.s390x", "product_id": "mailman-2.1.23-1.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "mailman-2.1.23-1.2.x86_64", "product": { "name": "mailman-2.1.23-1.2.x86_64", "product_id": "mailman-2.1.23-1.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.23-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64" }, "product_reference": "mailman-2.1.23-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.23-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le" }, "product_reference": "mailman-2.1.23-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.23-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x" }, "product_reference": "mailman-2.1.23-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mailman-2.1.23-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" }, "product_reference": "mailman-2.1.23-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2011-0707", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-0707" } ], "notes": [ { "category": "general", "text": "Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-0707", "url": "https://www.suse.com/security/cve/CVE-2011-0707" }, { "category": "external", "summary": "SUSE Bug 671745 for CVE-2011-0707", "url": "https://bugzilla.suse.com/671745" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-0707" }, { "cve": "CVE-2015-2775", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2775" } ], "notes": [ { "category": "general", "text": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2775", "url": "https://www.suse.com/security/cve/CVE-2015-2775" }, { "category": "external", "summary": "SUSE Bug 925502 for CVE-2015-2775", "url": "https://bugzilla.suse.com/925502" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2015-2775" }, { "cve": "CVE-2016-6893", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6893" } ], "notes": [ { "category": "general", "text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6893", "url": "https://www.suse.com/security/cve/CVE-2016-6893" }, { "category": "external", "summary": "SUSE Bug 995352 for CVE-2016-6893", "url": "https://bugzilla.suse.com/995352" }, { "category": "external", "summary": "SUSE Bug 997205 for CVE-2016-6893", "url": "https://bugzilla.suse.com/997205" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64", "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le", "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x", "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2016-6893" } ] }
cnvd-2015-02542
Vulnerability from cnvd
Title: GNU Mailman目录遍历漏洞
Description:
GNU Mailman是一款邮件列表应用。
GNU Mailman存在目录遍历漏洞。允许远程攻击者利用漏洞提交特殊的目录遍历请求,获取敏感文件内容。
Severity: 高
Patch Name: GNU Mailman目录遍历漏洞的补丁
Patch Description:
GNU Mailman是一款邮件列表应用。
GNU Mailman存在目录遍历漏洞。允许远程攻击者利用漏洞提交特殊的目录遍历请求,获取敏感文件内容。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description:
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: https://launchpad.net/mailman/+milestone/2.1.20
Reference: https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2775
Name | Gnu Mailman < 2.1.20 |
---|
{ "bids": { "bid": { "bidNumber": "73922" } }, "cves": { "cve": { "cveNumber": "CVE-2015-2775" } }, "description": "GNU Mailman\u662f\u4e00\u6b3e\u90ae\u4ef6\u5217\u8868\u5e94\u7528\u3002\r\n\r\nGNU Mailman\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u76ee\u5f55\u904d\u5386\u8bf7\u6c42\uff0c\u83b7\u53d6\u654f\u611f\u6587\u4ef6\u5185\u5bb9\u3002", "discovererName": "Jakub Wilk", "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttps://launchpad.net/mailman/+milestone/2.1.20", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2015-02542", "openTime": "2015-04-20", "patchDescription": "GNU Mailman\u662f\u4e00\u6b3e\u90ae\u4ef6\u5217\u8868\u5e94\u7528\u3002\r\n\r\nGNU Mailman\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u76ee\u5f55\u904d\u5386\u8bf7\u6c42\uff0c\u83b7\u53d6\u654f\u611f\u6587\u4ef6\u5185\u5bb9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "GNU Mailman\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01", "products": { "product": "Gnu Mailman \u003c 2.1.20" }, "referenceLink": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2775", "serverity": "\u9ad8", "submitTime": "2015-04-16", "title": "GNU Mailman\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e" }
ghsa-rhjr-qgg7-67wg
Vulnerability from github
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
{ "affected": [], "aliases": [ "CVE-2015-2775" ], "database_specific": { "cwe_ids": [ "CWE-22" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2015-04-13T14:59:00Z", "severity": "HIGH" }, "details": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.", "id": "GHSA-rhjr-qgg7-67wg", "modified": "2022-05-17T03:17:25Z", "published": "2022-05-17T03:17:25Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2775" }, { "type": "WEB", "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "type": "WEB", "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "type": "WEB", "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "type": "WEB", "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "type": "WEB", "url": "http://www.debian.org/security/2015/dsa-3214" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/73922" }, { "type": "WEB", "url": "http://www.securitytracker.com/id/1032033" }, { "type": "WEB", "url": "http://www.ubuntu.com/usn/USN-2558-1" } ], "schema_version": "1.4.0", "severity": [] }
fkie_cve-2015-2775
Vulnerability from fkie_nvd
Vendor | Product | Version | |
---|---|---|---|
canonical | ubuntu_linux | 12.04 | |
canonical | ubuntu_linux | 14.04 | |
canonical | ubuntu_linux | 14.10 | |
debian | debian_linux | 7.0 | |
redhat | enterprise_linux | 7.0 | |
gnu | mailman | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*", "matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359", "vulnerable": true }, { "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true }, { "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:gnu:mailman:*:*:*:*:*:*:*:*", "matchCriteriaId": "D12BCF8B-CA13-4A87-9498-C01C4F58980F", "versionEndIncluding": "2.1.19", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name." }, { "lang": "es", "value": "Vulnerabilidad de salto de directorio en GNU Mailman anterior a 2.1.20, cuando no utiliza un alias est\u00e1tico, permite a atacantes remotos ejecutar ficheros arbitrarios a trav\u00e9s de un .. (punto punto) en un nombre de lista." } ], "id": "CVE-2015-2775", "lastModified": "2025-04-12T10:46:40.837", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0" }, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ] }, "published": "2015-04-13T14:59:02.397", "references": [ { "source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3214" }, { "source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/73922" }, { "source": "cve@mitre.org", "url": "http://www.securitytracker.com/id/1032033" }, { "source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "source": "cve@mitre.org", "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "source": "cve@mitre.org", "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "source": "cve@mitre.org", "tags": [ "Exploit" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-1153.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-1417.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3214" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/73922" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1032033" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2558-1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.launchpad.net/mailman/+bug/1437145" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit" ], "url": "https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.