Sympa creates temporary files in an insecure manner. An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible. Sympa 5.4.3 is vulnerable other versions may also be affected.

Updates are available. Please see the references for more information.

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494969
• http://www.securityfocus.com/bid/30727
• http://www.sympa.org/
• http://www.sympa.org/distribution/

---

Updated on 2015-03-25