Security Information / 2015 / Security Information -- DSA-3214-1 mailman

Debian Security Advisory

DSA-3214-1 mailman -- security update

Date Reported:

06 Apr 2015

Affected Packages:

mailman

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 781626.
In Mitre's CVE dictionary: CVE-2015-2775.

More information:

A path traversal vulnerability was discovered in Mailman, the mailing list manager. Installations using a transport script (such as postfix-to-mailman.py) to interface with their MTA instead of static aliases were vulnerable to a path traversal attack. To successfully exploit this, an attacker needs write access on the local file system.

For the stable distribution (wheezy), this problem has been fixed in version 1:2.1.15-1+deb7u1.

For the unstable distribution (sid), this problem has been fixed in version 1:2.1.18-2.

We recommend that you upgrade your mailman packages.