Mandriva Linux Security Advisory : mailman (MDVSA-2008:061)

Medium Nessus Plugin ID 36638


The remote Mandriva Linux host is missing a security update.


Multiple cross-site scripting (XSS) vulnerabilities were found in Mailman prior to version 2.1.10b1, which allow remote attackers to inject arbitrary web script or HTML via edting templates and the list's info attribute in the web administrator interface.

The updated packages have been patched to correct these issues.


Update the affected mailman package.

Plugin Details

Severity: Medium

ID: 36638

File Name: mandriva_MDVSA-2008-061.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2009/04/23

Modified: 2013/06/01

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:mailman, cpe:/o:mandriva:linux:2007, cpe:/o:mandriva:linux:2007.1, cpe:/o:mandriva:linux:2008.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2008/03/06

Reference Information

CVE: CVE-2008-0564

MDVSA: 2008:061

CWE: 79