Debian Security Advisory

DLA-1272-1 mailman -- LTS security update

Date Reported:
09 Feb 2018
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 888201.
In Mitre's CVE dictionary: CVE-2018-5950.
More information:

The mailman package has a Cross-site scripting (XSS) vulnerability in the web UI before 2.1.26 which allows remote attackers to inject arbitrary web script or HTML via a user-options URL

For Debian 7 Wheezy, these problems have been fixed in version 1:2.1.15-1+deb7u3

We recommend that you upgrade your mailman packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: