CVE-2015-1306 The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sympa(Debian:12) | < 6.1.23~dfsg-2 | 6.1.23~dfsg-2 |
| debian/sympa(Debian:13) | < 6.1.23~dfsg-2 | 6.1.23~dfsg-2 |
| debian/sympa(Debian:14) | < 6.1.23~dfsg-2 | 6.1.23~dfsg-2 |
| sympa | = 6.0.0 | No fix listed |
| sympa | = 6.0.1 | No fix listed |
| sympa | = 6.0.2 | No fix listed |
| sympa | = 6.0.3 | No fix listed |
| sympa | = 6.0.4 | No fix listed |
| sympa | = 6.0.5 | No fix listed |
| sympa | = 6.0.6 | No fix listed |
| sympa | = 6.0.7 | No fix listed |
| sympa | = 6.0.8 | No fix listed |
| sympa | = 6.0.9 | No fix listed |
| sympa | = 6.1.0 | No fix listed |
| sympa | = 6.1.1 | No fix listed |
| sympa | = 6.1.2 | No fix listed |
| sympa | = 6.1.3 | No fix listed |
| sympa | = 6.1.4 | No fix listed |
| sympa | = 6.1.5 | No fix listed |
| sympa | = 6.1.6 | No fix listed |
| sympa | = 6.1.7 | No fix listed |
| sympa | = 6.1.8 | No fix listed |
| sympa | = 6.1.9 | No fix listed |
| sympa | = 6.1.10 | No fix listed |
| sympa | = 6.1.11 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sympa | = 6.1.12 | No fix listed |
| sympa | = 6.1.13 | No fix listed |
| sympa | = 6.1.14 | No fix listed |
| sympa | = 6.1.15 | No fix listed |
| sympa | = 6.1.16 | No fix listed |
| sympa | = 6.1.17 | No fix listed |
| sympa | = 6.1.18 | No fix listed |
| sympa | = 6.1.19 | No fix listed |
| sympa | = 6.1.20 | No fix listed |
| sympa | = 6.1.21 | No fix listed |
| sympa | = 6.1.22 | No fix listed |
| sympa | = 6.1.23 | No fix listed |
References
- Debian Security Tracker CVE-2015-1306 vendor-advisory
- advisories.mageia.org
- 62387 third-party-advisory
- 62442 third-party-advisory
- DSA-3134 vendor-advisory
- MDVSA-2015:051 vendor-advisory
- [oss-security] 20150120 Possible CVE request: sympa: vulnerability in the web interface mailing-list
- 72277 vdb-entry
- www.sympa.org patch vendor-advisory