Debian 3.0: DSA-436-1 Critical: Mailman XSS Remote Attack

Several vulnerabilities have been fixed in the mailman package:

- CAN-2003-0038 - potential cross-site scripting via certain CGI
parameters (not known to be exploitable in this version)

- CAN-2003-0965 - cross-site scripting in the administrative
interface

- CAN-2003-0991 - certain malformed email commands could cause the
mailman process to crash

The cross-site scripting vulnerabilities could allow an attacker to
perform administrative operations without authorization, by stealing a
session cookie.

For the current stable distribution (woody) these problems have been
fixed in version 2.0.11-1woody7.

For the unstable distribution (sid), CAN-2003-0965 is fixed in version
2.1.4-1, and CAN-2003-0038 in version 2.1.1-1. CAN-2003-0991 will be
fixed soon.

We recommend that you update your mailman package.

Upgrade Instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use...