Several security issues were fixed in Mailman.. =========================================================================Ubuntu Security Notice USN-4348-1 April 29, 2020 mailman vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Mailman. Software Description: - mailman: Web-based mailing list manager (legacy branch) Details: It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this to issue execute arbitrary scripts or HTML. (CVE-2018-0618) It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to display arbitrary text on a web page. (CVE-2018-13796) It was discovered that Mailman incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-12137) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: mailman 1:2.1.26-1ubuntu0.1 Ubuntu 16.04 LTS: mailman 1:2.1.20-1ubuntu0.4 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4348-1 CVE-2018-0618, CVE-2018-13796, CVE-2020-12137 Package Information: https://launchpad.net/ubuntu/+source/mailman/1:2.1.26-1ubuntu0.1 https://launchpad.net/ubuntu/+source/mailman/1:2.1.20-1ubuntu0.4 . Recent Ubuntu releases have resolved security vulnerabilities in Mailman. This notice offers update instructions and an overview of the related potential risks. Mailman Vulnerabilities, Ubuntu Security Notice, Input Handling Issues. . LinuxSecurity.com Team
mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages * mailman: Mishandled URLs in Utils.py:GetPathPieces() allows attackers to display arbitrary text on trusted sites SL7 x86_64 mailman-2.1.15-30.el7.x86_64.rpm mailman-debuginfo-2.1.15-30.el7.x86_64.rpm - Scientific Linux Development Team. Synopsis: Moderate: mailman security and bug fix update Advisory ID: SLSA-2020:1054-1 Issue Date: 2020-04-07 CVE Numbers: CVE-2018-0618 CVE-2018-13796 -- * mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages * mailman: Mishandled URLs in Utils.py:GetPathPieces() allows attackers to display arbitrary text on trusted sites -- SL7 x86_64 mailman-2.1.15-30.el7.x86_64.rpm mailman-debuginfo-2.1.15-30.el7.x86_64.rpm - Scientific Linux Development Team . The recent Mailman update for SL7.0 addresses notable cross-site scripting flaws, ensuring enhanced security measures.. mailman security, cross-site scripting, SL7 mailman, mailman update, security patch. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.