Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:14356-1

Опубликовано: 05 мая 2020
Источник: suse-cvrf

Описание

Security update for mailman

This update for mailman fixes the following issues:

Security issue fixed:

  • CVE-2020-12137: Fixed a XSS vulnerability caused by MIME type confusion (bsc#1170558).

Non-security issue fixed:

  • Fixed rights and ownership on /var/lib/mailman/archives (bsc#1167068).

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
mailman-2.1.15-9.6.20.1
SUSE Linux Enterprise Server 11 SP4-LTSS
mailman-2.1.15-9.6.20.1

Ссылки

Описание

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.20.1
SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.20.1
Ссылки