Debian Security Advisory
DLA-186-1 mailman -- LTS security update
- Date Reported:
- 06 Apr 2015
- Affected Packages:
- mailman
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 781626.
In Mitre's CVE dictionary: CVE-2015-2775. - More information:
-
A path traversal vulnerability was discovered in Mailman, the mailing list manager. Installations using a transport script (such as postfix-to-mailman.py) to interface with their MTA instead of static aliases were vulnerable to a path traversal attack. To successfully exploit this, an attacker needs write access on the local file system.
For Debian 6
Squeeze
, these issues have been fixed in mailman version 1:2.1.13-6