Description
Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | mailman | 3:2.1.12-25.el6 | RHSA-2015:1417 |
Advisories 1
- RHSA-2015:1417 Red Hat Security Advisory: mailman security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2015:1417 vendor-advisory
- 4538 vdb-entry
- http://sourceforge.net/tracker/?func=detail&atid=100103&aid=474616&group_id=103
- pipermail-view-archives(8874) vdb-entry
- 20020417 Mailman/Pipermail private mailing list/local user vulnerability mailing-list