RHSA-2011:0307: Moderate: mailman security update
Mailman is a program used to help manage email discussion lists.Multiple input sanitization flaws were found in the way Mailman displayedusernames of subscribed users on certain pages. If a user who is subscribedto a mailing list were able to trick a victim into visiting one of thosepages, they could perform a cross-site scripting (XSS) attack against thevictim. (CVE-2011-0707)Multiple input sanitization flaws were found in the way Mailman displayedmailing list information. A mailing list administrator could use this flawto conduct a cross-site scripting (XSS) attack against victims viewing alist's "listinfo" page. (CVE-2008-0564, CVE-2010-3089)Red Hat would like to thank Mark Sapiro for reporting the CVE-2011-0707 andCVE-2010-3089 issues.Users of mailman should upgrade to this updated package, which containsbackported patches to correct these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:0307?
RHSA-2011:0307 is classified as having moderate severity due to multiple input sanitization flaws.
How do I fix RHSA-2011:0307?
To fix RHSA-2011:0307, update to Mailman version 2.1.9-6.el5_6.1 or 2.1.5.1-34.rhel4.7 as appropriate.
What versions of Mailman are affected by RHSA-2011:0307?
RHSA-2011:0307 affects Mailman versions earlier than 2.1.9-6.el5_6.1 and 2.1.5.1-34.rhel4.7.
What types of attacks are possible with RHSA-2011:0307?
RHSA-2011:0307 may allow an attacker to execute a cross-site scripting (XSS) attack by tricking a victim to visit a malicious link.
Is there a workaround for RHSA-2011:0307?
No specific workaround is recommended for RHSA-2011:0307; the best mitigation is to apply the available updates.