CVE-2015-2775: Path Traversal
Published Apr 13, 2015
·Updated
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
Affected Software
6 affected components
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
Debian Debian Linux=7.0
redhat Enterprise Linux=7.0
GNU Mailman<=2.1.19
Event History
Apr 13, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2775?
CVE-2015-2775 is rated as a medium severity vulnerability due to its potential to allow arbitrary file execution.
2
What systems are affected by CVE-2015-2775?
CVE-2015-2775 affects GNU Mailman versions prior to 2.1.20 on various operating systems including Ubuntu, Debian, and Red Hat.
3
How do I fix CVE-2015-2775?
To fix CVE-2015-2775, upgrade to GNU Mailman version 2.1.20 or later.
4
What kind of attack does CVE-2015-2775 enable?
CVE-2015-2775 enables remote attackers to execute arbitrary files through directory traversal via a crafted list name.
5
When was CVE-2015-2775 disclosed?
CVE-2015-2775 was disclosed in April 2015.