[CVE-2008-0564] Multiple cross-site scripting (XSS) vulnerabilities in Mailman

[Emanuele Gentili]

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) editing templates and (2) the list's "info attribute" in the web administrator interface, a different vulnerability than CVE-2006-3636.

[1] http://mail.python.org/pipermail/mailman-announce/2008-February/000095.html
[2] http://mail.python.org/pipermail/mailman-announce/2008-February/000096.html

[Launchpad Janitor (janitor)]

This bug was fixed in the package mailman - 1:2.1.9-9ubuntu1

---------------
mailman (1:2.1.9-9ubuntu1) hardy; urgency=low

  * debian/control:
   + updated maintainer field
  * SECURITY UPDATE:
   + debian/patches/100_CVE-2008-0564.dpatch (LP: #199338)
    - Multiple cross-site scripting (XSS) vulnerabilities in Mailman
      before 2.1.10b1 allow remote attackers to inject arbitrary web
      script or HTML via unspecified vectors related to (1) editing
      templates and (2) the list's "info attribute" in the web
      administrator interface.
  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0564
   + http://bugs.gentoo.org/show_bug.cgi?id=208710

 -- Emanuele Gentili <email address hidden> Fri, 07 Mar 2008 02:55:22 +0100

[Kees Cook (kees)]

Dapper and Edgy patches cannot include maintainer field updates.

[Kees Cook (kees)]

Feisty and Gutsy uploaded, thanks! They should be published shortly.

[Emanuele Gentili (emgent)]

I dont understand problem about Dapper and Edgy, i was update maintainer field out the patch system, where is the problem?

Cheers,

Emanuele

[Emanuele Gentili (emgent)]

Thanks, please use this for upload.

[Emanuele Gentili (emgent)]

Thanks, please use this for upload in edgy.

[Kees Cook (kees)]

Thanks! Dapper/Edgy uploaded.

[Launchpad Janitor (janitor)]

This bug was fixed in the package mailman - 1:2.1.9-8ubuntu0.1

---------------
mailman (1:2.1.9-8ubuntu0.1) gutsy-security; urgency=low

  * debian/control:
   + updated maintainer field
  * SECURITY UPDATE:
   + debian/patches/100_CVE-2008-0564.dpatch (LP: #199338)
    - Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow
      remote attackers to inject arbitrary web script or HTML via unspecified vectors related
      to (1) editing templates and (2) the list's "info attribute" in the web administrator interface.
  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0564
   + http://bugs.gentoo.org/show_bug.cgi?id=208710

 -- Emanuele Gentili <email address hidden> Fri, 07 Mar 2008 03:52:46 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package mailman - 1:2.1.9-4ubuntu1.1

---------------
mailman (1:2.1.9-4ubuntu1.1) feisty-security; urgency=low

  * debian/control:
   + updated maintainer field
  * SECURITY UPDATE:
   + debian/patches/100_CVE-2008-0564.dpatch (LP: #199338)
    - Multiple cross-site scripting (XSS) vulnerabilities in Mailman
      before 2.1.10b1 allow remote attackers to inject arbitrary web
      script or HTML via unspecified vectors related to (1) editing
      templates and (2) the list's "info attribute" in the web
      administrator interface.
  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0564
   + http://bugs.gentoo.org/show_bug.cgi?id=208710

 -- Emanuele Gentili <email address hidden> Fri, 07 Mar 2008 05:38:51 +0100