FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-3089

This CVE name corresponds to:

Entered	Topic
2010-11-03	Mailman -- cross-site scripting in web interface

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-3089 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-3089
Phase	Assigned(20100820)

Description

Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.

References

Source	Reference
MLIST	[mailman-announce] 20100905 Mailman security patch.
MLIST	[mailman-announce] 20100909 Mailman security patch.
MLIST	[oss-security] 20100913 CVE Request: mailman
MLIST	[oss-security] 20100913 Re: CVE Request: mailman
MLIST	[oss-security] 20100913 Re: CVE Request: mailman
MLIST	[oss-security] 20100913 Re: CVE Request: mailman
MLIST	[oss-security] 20100913 Re: CVE Request: mailman
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=631859
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=631881
CONFIRM	https://launchpad.net/mailman/+milestone/2.1.14rc1
CONFIRM	http://support.apple.com/kb/HT4581
APPLE	APPLE-SA-2011-03-21-1
DEBIAN	DSA-2170
FEDORA	FEDORA-2010-14834
FEDORA	FEDORA-2010-14877
REDHAT	RHSA-2011:0307
REDHAT	RHSA-2011:0308
SUSE	SUSE-SR:2011:009
SUSE	openSUSE-SU-2011:0424
UBUNTU	USN-1069-1
SECUNIA	41265
SECUNIA	42502
SECUNIA	43294
SECUNIA	43425
SECUNIA	43549
SECUNIA	43580
VUPEN	ADV-2010-3271
VUPEN	ADV-2011-0436
VUPEN	ADV-2011-0460
VUPEN	ADV-2011-0542