A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user.

For the stable distribution (wheezy), this problem has been fixed in version 6.1.11~dfsg-5+deb7u2. For the upcoming stable distribution (jessie), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 6.1.23~dfsg-2. We recommend that you upgrade your sympa packages.

Sympa is a scalable and highly customizable modern mailing list manager capable of handling big setups: 20.000 lists with 700,000 subscribers.

sympa on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2015/dsa-3134.html

---

Updated on 2015-03-25