Mailman contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'full name' or 'username' fields in confirmation messages upon submission to the Cgi/confirm.py script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Currently, there are no known workarounds or upgrades to correct this issue. However, Mailman has released a patch to address this vulnerability.

• Security Tracker: 1025106
• CVE ID: 2011-0707 (see also: NVD)
• Secunia Advisory ID: 43294 43389 43425 43549 43580 43829 44068 46417
• Bugtraq ID: 46464
• ISS X-Force ID: 65538
• VUPEN Advisory: ADV-2011-0435 ADV-2011-0436 ADV-2011-0460 ADV-2011-0487 ADV-2011-0542 ADV-2011-0720
• Mail List Post: http://lists.apple.com/archives/security-announce/2011/Oct//msg00003.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056399.html
  http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056363.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056387.html
• Other Advisory URL: http://mail.python.org/pipermail/mailman-announce/2011-February/000158.html
  http://www.debian.org/security/2011/dsa-2170
  http://www.mandriva.com/security/advisories?name=MDVSA-2011:036
  http://www.ubuntu.com/usn/USN-1069-1
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5002
  http://www.debian.org/security/2011/dsa-2170
  http://www.ubuntu.com/usn/usn-1069-1
  https://hermes.opensuse.org/messages/7856168
• RedHat RHSA: RHSA-2011:0307 RHSA-2011:0308

• Not Available