Description
Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) editing templates and (2) the list's "info attribute" in the web administrator interface, a different vulnerability than CVE-2006-3636.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mailman | 3:2.1.9-6.el5_6.1 | RHSA-2011:0307 |
| RHEL 4 | mailman | 3:2.1.5.1-34.rhel4.7 | RHSA-2011:0307 |
Advisories 1
- RHSA-2011:0307 Red Hat Security Advisory: mailman security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- SUSE-SR:2008:017 vendor-advisory
- MDVSA-2008:061 vendor-advisory
- RHSA-2011:0307 vendor-advisory
- https://issues.rpath.com/browse/RPL-2207
- ADV-2008-0422 vdb-entry
- 31687 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0056
- FEDORA-2008-1334 vendor-advisory
- 28966 third-party-advisory
- USN-586-1 vendor-advisory
- http://support.apple.com/kb/HT4077
- http://sourceforge.net/project/shownotes.php?release_id=559308&group_id=103
- 28916 third-party-advisory
- [Mailman-Announce] 20080203 Mailman 2.1.10b3 Released (was: Re: Mailman 2.1.10b1 Released) mailing-list
- 20080215 rPSA-2008-0056-1 mailman mailing-list
- 29388 third-party-advisory
- 27630 vdb-entry
- ADV-2011-0542 vdb-entry
- 28794 third-party-advisory
- 29249 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=431526
- 43549 third-party-advisory