CVE-2015-2775

Mailman could be made to run programs if it processed a specially crafted list name ...

Debian Bug report logs - #781626 mailman: CVE-2015-2775: Path traversal vulnerability Package: src:mailman; Maintainer for src:mailman is Mailman for Debian <pkg-mailman-hackers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 31 Mar 2015 18:51:01 UTC Severity: important Tags ...

A path traversal vulnerability was discovered in Mailman, the mailing list manager Installations using a transport script (such as postfix-to-mailmanpy) to interface with their MTA instead of static aliases were vulnerable to a path traversal attack To successfully exploit this, an attacker needs write access on the local file system For the st ...

It was found that mailman did not sanitize the list name before passing it to certain MTAs A local attacker could use this flaw to execute arbitrary code as the user running mailman (CVE-2015-2775) It was found that mailman stored private email messages in a world-readable directory A local user could use this flaw to read private mailing list a ...

It was found that mailman did not sanitize the list name before passing it to certain MTAs A local attacker could use this flaw to execute arbitrary code as the user running mailman ...