[SECURITY] [DLA 186-1] mailman security update

2015-04-0617:13:43

lists.debian.org

CVSS2

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

AI Score

6.1

Confidence

High

EPSS

0.031

Percentile

91.0%

JSON

Package : mailman
Version : 1:2.1.13-6
CVE ID : CVE-2015-2775
Debian Bug : 781626

A path traversal vulnerability was discovered in Mailman, the mailing
list manager. Installations using a transport script (such as
postfix-to-mailman.py) to interface with their MTA instead of static
aliases were vulnerable to a path traversal attack. To successfully
exploit this, an attacker needs write access on the local file system.

OSVersionArchitecturePackageVersionFilename
Debian7s390mailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_s390.deb
Debian7sparcmailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_sparc.deb
Debian7armhfmailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_armhf.deb
Debian7powerpcmailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_powerpc.deb
Debian7i386mailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_i386.deb
Debian7allmailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_all.deb
Debian7amd64mailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_amd64.deb
Debian6allmailman< 1:2.1.13-6mailman_1:2.1.13-6_all.deb
Debian7kfreebsd-amd64mailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_kfreebsd-amd64.deb
Debian7mipsmailman< 1:2.1.15-1+deb7u1mailman_1:2.1.15-1+deb7u1_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	s390	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_s390.deb
Debian	7	sparc	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_sparc.deb
Debian	7	armhf	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_armhf.deb
Debian	7	powerpc	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_powerpc.deb
Debian	7	i386	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_i386.deb
Debian	7	all	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_all.deb
Debian	7	amd64	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_amd64.deb
Debian	6	all	mailman	< 1:2.1.13-6	mailman_1:2.1.13-6_all.deb
Debian	7	kfreebsd-amd64	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_kfreebsd-amd64.deb
Debian	7	mips	mailman	< 1:2.1.15-1+deb7u1	mailman_1:2.1.15-1+deb7u1_mips.deb