MidnightBSD

Advisories for sympa

CVE-2004-1735 MEDIUM

Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject arbitrary web script or HTML via the description field.

CVSS 2.0

Severity: MEDIUM

Problem Type: NVD-CWE-Other,

Products Affected

Vendor Product Version
sympa sympa 4.0
sympa sympa 4.1.2
sympa sympa 4.1
sympa sympa 4.1.1
CVE-2008-1648 MEDIUM

Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Content-Type header and unspecified other headers. NOTE: some of these details are obtained from third party information.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-20,

Products Affected

Vendor Product Version
sympa sympa 3.3.3
sympa sympa 3.2.2a
sympa sympa 2.7.2
sympa sympa 4.0.a1
sympa sympa 4.0.b1
sympa sympa 3.3.4b.8
sympa sympa 2.2.6
sympa sympa 0.004
sympa sympa 3.3b.4
sympa sympa 1.4.2-1
sympa sympa 2.5
sympa sympa 4.0.a5
sympa sympa 0.009
sympa sympa 1.4.0
sympa sympa 4.0.a3
sympa sympa 5.3b.5
sympa sympa 3.1b.12
sympa sympa 2.2.7
sympa sympa 5.3b.4
sympa sympa 3.1b.9
sympa sympa 4.0.a7
sympa sympa 3.1
sympa sympa 2.2.4
sympa sympa 3.3.4b.3
sympa sympa 3.0a.1
sympa sympa 2.3.2
sympa sympa 4.0.a4
sympa sympa 3.0
sympa sympa 2.7b.3
sympa sympa 1.3.4
sympa sympa 1.4.2
sympa sympa 5.4a.4
sympa sympa 5.0a
sympa sympa 5.3.2
sympa sympa 5.3a.9
sympa sympa 2.7a
sympa sympa 3.0b.9
sympa sympa 2.2b
sympa sympa 5.2b2
sympa sympa 2.3beta
sympa sympa 3.3.1
sympa sympa 3.3.4b.5
sympa sympa 0.005
sympa sympa 1.2.0
sympa sympa 2.2.3b
sympa sympa 3.1b.7
sympa sympa 5.0b.1
sympa sympa 2.5.4b
sympa sympa 5.3b.1
sympa sympa 2.7.3
sympa sympa 5.4a.2
sympa sympa 3.3b.3
sympa sympa 5.1.2
sympa sympa 5.2b
sympa sympa 3.3.5
sympa sympa 3.1b.13
sympa sympa 1.3.4-1
sympa sympa 5.0
sympa sympa 3.3.6b.6
sympa sympa 1.3.1
sympa sympa 2.3.4
sympa sympa 3.3a-vhost.10
sympa sympa 4.0.a9
sympa sympa 0.007
sympa sympa 0.001
sympa sympa 5.3a.10
sympa sympa 1.2.2
sympa sympa 4.0.a6
sympa sympa 2.3.1
sympa sympa 5.3a.8
sympa sympa 3.3.4b.6
sympa sympa 2.7b.2
sympa sympa 3.3.6b.3
sympa sympa 3.4
sympa sympa 1.3.0
sympa sympa 3.3
sympa sympa 4.2b.3
sympa sympa 2.2.5
sympa sympa 5.3b.3
sympa sympa 0.011
sympa sympa 2.2.1b
sympa sympa 0.006
sympa sympa 2.3.3
sympa sympa 3.0b.8
sympa sympa 1.3.1-2
sympa sympa 3.1b.8
sympa sympa 3.0a
sympa sympa 3.3.6b.5
sympa sympa 3.3.4b.4
sympa sympa 5.3
sympa sympa 4.0.a8
sympa sympa 0.008
sympa sympa 5.4b.1
sympa sympa 4.2b.1
sympa sympa 0.010
sympa sympa 2.4
sympa sympa 3.1.1
sympa sympa 2.6.1
sympa sympa 5.0a.1
sympa sympa 3.3.6b.2
sympa sympa 3.1b.10
sympa sympa 2.3.0
sympa sympa 2.7.1
sympa sympa 0.003
sympa sympa 4.0
sympa sympa 2.7
sympa sympa 4.1
sympa sympa 3.2
sympa sympa 2.5.3b
sympa sympa 1.2.1
sympa sympa 5.2
sympa sympa 3.2.1
sympa sympa 3.3.6b.4
sympa sympa 3.0b.4
sympa sympa 1.3.2
sympa sympa 2.6
sympa sympa 1.3.3
sympa sympa 2.5.2
sympa sympa 5.0b
sympa sympa 3.3.4b.9
sympa sympa 4.0.b2
sympa sympa 2.5.1
sympa sympa 1.5
sympa sympa 4.0.b3
sympa sympa 3.3.4b.7
sympa sympa 0.002
sympa sympa 2.7b.1
sympa sympa 2.2.2b
sympa sympa 5.1
CVE-2008-4476 MEDIUM

sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporary file. NOTE: wwsympa.fcgi was also reported, but the issue occurred in a dead function, so it is not a vulnerability.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-59,

Products Affected

Vendor Product Version
sympa sympa 5.3.4
CVE-2012-2352 HIGH

The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the (1) do_arc_manage, (2) do_arc_download, or (3) do_arc_delete functions.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-264,

Products Affected

Vendor Product Version
sympa sympa 3.3.3
sympa sympa 3.2.2a
sympa sympa 2.7.2
sympa sympa 4.0.a1
sympa sympa 5.4.3
sympa sympa 2.3
sympa sympa 4.0.b1
sympa sympa 3.3.4b.8
sympa sympa 2.2.6
sympa sympa 0.004
sympa sympa 3.3b.4
sympa sympa 6.1b.3
sympa sympa 1.4.2-1
sympa sympa 6.0b.4
sympa sympa 2.5
sympa sympa 1.4.1
sympa sympa 4.0.a5
sympa sympa 0.009
sympa sympa *
sympa sympa 1.4.0
sympa sympa 5.3b.5
sympa sympa 4.0.a3
sympa sympa 3.1b.12
sympa sympa 2.2.7
sympa sympa 6.0.2
sympa sympa 5.3b.4
sympa sympa 3.1b.9
sympa sympa 6.0.6
sympa sympa 6.0
sympa sympa 4.0.a7
sympa sympa 3.1
sympa sympa 2.2.4
sympa sympa 3.3.4b.3
sympa sympa 3.0a.1
sympa sympa 2.3.2
sympa sympa 4.0.a4
sympa sympa 2.7b.3
sympa sympa 6.0b.2
sympa sympa 1.3.4
sympa sympa 3.0
sympa sympa 1.4.2
sympa sympa 5.4a.4
sympa sympa 5.3.2
sympa sympa 5.3a.9
sympa sympa 5.0a
sympa sympa 2.7a
sympa sympa 3.0b.9
sympa sympa 2.2b
sympa sympa 5.2b2
sympa sympa 6.0.5
sympa sympa 5.4
sympa sympa 6.1.3
sympa sympa 3.3.1
sympa sympa 3.3.4b.5
sympa sympa 6.1.1
sympa sympa 0.005
sympa sympa 1.2.0
sympa sympa 2.2.3b
sympa sympa 3.1b.7
sympa sympa 5.0b.1
sympa sympa 2.5.4b
sympa sympa 5.3b.1
sympa sympa 2.7.3
sympa sympa 3.3b.3
sympa sympa 5.4a.2
sympa sympa 5.1.2
sympa sympa 3.3.5
sympa sympa 5.2b
sympa sympa 3.1b.13
sympa sympa 5.0
sympa sympa 1.3.4-1
sympa sympa 3.3.6b.6
sympa sympa 1.3.1
sympa sympa 6.1b.1
sympa sympa 2.3.4
sympa sympa 4.0.a9
sympa sympa 6.0b.1
sympa sympa 0.001
sympa sympa 0.007
sympa sympa 5.3a.10
sympa sympa 1.2.2
sympa sympa 4.0.a6
sympa sympa 2.3.1
sympa sympa 5.3a.8
sympa sympa 3.3.4b.6
sympa sympa 2.7b.2
sympa sympa 3.3.6b.3
sympa sympa 3.4
sympa sympa 6.1.2
sympa sympa 1.3.0
sympa sympa 6.0.4
sympa sympa 6.0.3
sympa sympa 3.3
sympa sympa 4.2b.3
sympa sympa 6.1b.4
sympa sympa 2.2.5
sympa sympa 5.3b.3
sympa sympa 0.011
sympa sympa 2.2.1b
sympa sympa 0.006
sympa sympa 3.0b.8
sympa sympa 2.3.3
sympa sympa 6.1.9
sympa sympa 1.3.1-2
sympa sympa 3.0a
sympa sympa 3.1b.8
sympa sympa 3.3.6b.5
sympa sympa 3.3.4b.4
sympa sympa 5.3
sympa sympa 0.008
sympa sympa 4.0.a8
sympa sympa 0.010
sympa sympa 5.4b.1
sympa sympa 4.2b.1
sympa sympa 2.4
sympa sympa 3.1.1
sympa sympa 6.1.8
sympa sympa 5.0a.1
sympa sympa 3.3.6b.2
sympa sympa 2.6.1
sympa sympa 3.1b.10
sympa sympa 6.1.4
sympa sympa 2.7.1
sympa sympa 2.3.0
sympa sympa 0.003
sympa sympa 6.1.5
sympa sympa 2.7
sympa sympa 4.1
sympa sympa 6.1b.6
sympa sympa 3.2
sympa sympa 2.5.3b
sympa sympa 1.2.1
sympa sympa 5.2
sympa sympa 3.2.1
sympa sympa 6.0b.3
sympa sympa 3.3.6b.4
sympa sympa 3.0b.4
sympa sympa 1.3.2
sympa sympa 5.4.2
sympa sympa 6.1b.2
sympa sympa 3.3.6b.1
sympa sympa 5.4.1
sympa sympa 2.6
sympa sympa 1.3.3
sympa sympa 5.0b
sympa sympa 2.5.2
sympa sympa 3.3.4b.9
sympa sympa 4.0.b2
sympa sympa 4.0.b3
sympa sympa 2.5.1
sympa sympa 6.0.1
sympa sympa 1.5
sympa sympa 3.3.4b.7
sympa sympa 0.002
sympa sympa 6.1.6
sympa sympa 6.1.7
sympa sympa 2.7b.1
sympa sympa 5.1
sympa sympa 2.2.2b
CVE-2015-1306 MEDIUM

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-200,

Products Affected

Vendor Product Version
sympa sympa 6.0.9
sympa sympa 6.1.21
sympa sympa 6.1.16
sympa sympa 6.1.5
sympa sympa 6.1.17
sympa sympa 6.0.7
sympa sympa 6.1.19
sympa sympa 6.1.12
sympa sympa 6.1.18
sympa sympa 6.0.5
sympa sympa 6.1.2
sympa sympa 6.1.3
sympa sympa 6.1.20
sympa sympa 6.1.1
sympa sympa 6.0.4
sympa sympa 6.0.3
sympa sympa 6.1.13
sympa sympa 6.1.14
sympa sympa 6.0.8
sympa sympa 6.1.9
sympa sympa 6.1.23
sympa sympa 6.1.22
sympa sympa 6.0.2
sympa sympa 6.0.0
sympa sympa 6.1.0
sympa sympa 6.0.6
sympa sympa 6.1.15
sympa sympa 6.1.11
sympa sympa 6.0.1
sympa sympa 6.1.8
sympa sympa 6.1.6
sympa sympa 6.1.10
sympa sympa 6.1.4
sympa sympa 6.1.7