Debian Security Advisory
DLA-1272-1 mailman -- LTS security update
- Date Reported:
- 09 Feb 2018
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 888201.
In Mitre's CVE dictionary: CVE-2018-5950.
- More information:
The mailman package has a Cross-site scripting (XSS) vulnerability in the web UI before 2.1.26 which allows remote attackers to inject arbitrary web script or HTML via a user-options URL
For Debian 7
Wheezy, these problems have been fixed in version 1:2.1.15-1+deb7u3
We recommend that you upgrade your mailman packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS