Debian Long Term Support / LTS Security Information / 2015 / Security Information -- DLA-148-1 sympa

Debian Security Advisory

DLA-148-1 sympa -- LTS security update

Date Reported:

07 Feb 2015

Affected Packages:

sympa

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2015-1306.

More information:

A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user.

For Debian 6 Squeeze, these issues have been fixed in sympa version 6.0.1+dfsg-4+squeeze3