DSA-3134-1 sympa -- security update

Debian Security Advisory

DSA-3134-1 sympa -- security update

Date Reported:

20 Jan 2015

Affected Packages:

sympa

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2015-1306.

More information:

A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user.

For the stable distribution (wheezy), this problem has been fixed in version 6.1.11~dfsg-5+deb7u2.

For the upcoming stable distribution (jessie), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 6.1.23~dfsg-2.

We recommend that you upgrade your sympa packages.