Amazon Linux 1 Security Advisory: ALAS-2015-582
Advisory Release Date: 2015-08-17 12:31 Pacific
Advisory Updated Date: 2015-08-17 12:31 Pacific
Severity:
Medium
References:
CVE-2002-0389
CVE-2015-2775
RHSA-2015-1417
FAQs regarding Amazon Linux ALAS/CVE Severity
FAQs regarding Amazon Linux ALAS/CVE Severity
Issue Overview:
It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman. (CVE-2015-2775)
It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives. (CVE-2002-0389)
Affected Packages:
mailman
Issue Correction:
Run yum update mailman to update your system.
New Packages:
i686:
mailman-2.1.15-21.20.amzn1.i686
mailman-debuginfo-2.1.15-21.20.amzn1.i686
src:
mailman-2.1.15-21.20.amzn1.src
x86_64:
mailman-debuginfo-2.1.15-21.20.amzn1.x86_64
mailman-2.1.15-21.20.amzn1.x86_64