high7.6

CVE-2015-2775

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a ..

Impact

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.

Affected products

Vendor	Product	Affected versions
Canonical	Ubuntu Linux	Versions 12.04, 14.04, 14.10
Debian	Debian Linux	Version 7.0
Redhat	Enterprise Linux	Version 7.0
Gnu	Mailman	through 2.1.19

Weakness classification

CWE-22

References

NVD record
CVE.org record
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html
http://rhn.redhat.com/errata/RHSA-2015-1153.html
http://rhn.redhat.com/errata/RHSA-2015-1417.html
http://www.debian.org/security/2015/dsa-3214
http://www.securityfocus.com/bid/73922
http://www.securitytracker.com/id/1032033
http://www.ubuntu.com/usn/USN-2558-1
https://bugs.launchpad.net/mailman/+bug/1437145
https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html
https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html
https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html
http://rhn.redhat.com/errata/RHSA-2015-1153.html
http://rhn.redhat.com/errata/RHSA-2015-1417.html
http://www.debian.org/security/2015/dsa-3214
http://www.securityfocus.com/bid/73922
http://www.securitytracker.com/id/1032033
http://www.ubuntu.com/usn/USN-2558-1
https://bugs.launchpad.net/mailman/+bug/1437145
https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html
https://mail.python.org/pipermail/mailman-developers/2015-March/024871.html
https://mail.python.org/pipermail/mailman-developers/2015-March/024875.html