CVE-2011-0707
Fixed in a distro release EPSS 4%
Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
Products: gnu mailman
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 5.0 | mailman | 1:2.1.11-11+lenny2 |
| Debian 6.0 | mailman | 1:2.1.13-5 |
| Red Hat Enterprise Linux 4 | mailman | 3:2.1.5.1-34.rhel4.7 |
| Red Hat Enterprise Linux 4 | mailman-debuginfo | 3:2.1.5.1-34.rhel4.7 |
| Red Hat Enterprise Linux 5 | mailman | 3:2.1.9-6.el5_6.1 |
| Red Hat Enterprise Linux 5 | mailman-debuginfo | 3:2.1.9-6.el5_6.1 |
| Red Hat Enterprise Linux 6 | mailman | 3:2.1.12-14.el6_0.2 |
| Red Hat Enterprise Linux 6 | mailman-debuginfo | 3:2.1.12-14.el6_0.2 |
| openSUSE Tumbleweed | mailman | 2.1.23-1.2 |