Description
Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | mailman | 1:2.1.13-5 | DSA-2170-1 |
| Debian 5.0 | mailman | 1:2.1.11-11+lenny2 | DSA-2170-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | mailman | 3:2.1.12-14.el6_0.2 | RHSA-2011:0308 |
| RHEL 5 | mailman | 3:2.1.9-6.el5_6.1 | RHSA-2011:0307 |
| RHEL 4 | mailman | 3:2.1.5.1-34.rhel4.7 | RHSA-2011:0307 |
Advisories 3
- RHSA-2011:0307 Red Hat Security Advisory: mailman security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0308 Red Hat Security Advisory: mailman security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2170-1 mailman - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20100913 CVE Request: mailman mailing-list
- RHSA-2011:0307 vendor-advisory
- [oss-security] 20100913 Re: CVE Request: mailman mailing-list
- FEDORA-2010-14877 vendor-advisory
- 43294 third-party-advisory
- SUSE-SR:2011:009 vendor-advisory
- ADV-2011-0460 vdb-entry
- openSUSE-SU-2011:0424 vendor-advisory
- DSA-2170 vendor-advisory
- FEDORA-2010-14834 vendor-advisory
- 42502 third-party-advisory
- [oss-security] 20100913 Re: CVE Request: mailman mailing-list
- https://launchpad.net/mailman/+milestone/2.1.14rc1
- USN-1069-1 vendor-advisory
- RHSA-2011:0308 vendor-advisory
- APPLE-SA-2011-03-21-1 vendor-advisory
- [oss-security] 20100913 Re: CVE Request: mailman mailing-list
- 41265 third-party-advisory
- ADV-2011-0436 vdb-entry
- [mailman-announce] 20100909 Mailman security patch. mailing-list
- ADV-2010-3271 vdb-entry
- [oss-security] 20100913 Re: CVE Request: mailman mailing-list
- 43425 third-party-advisory
- ADV-2011-0542 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=631881
- https://bugzilla.redhat.com/show_bug.cgi?id=631859
- 43580 third-party-advisory
- [mailman-announce] 20100905 Mailman security patch. mailing-list
- 43549 third-party-advisory
- http://support.apple.com/kb/HT4581