--===============4191504478460152995==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="dik3b7v4xtyfthsu"
Content-Disposition: inline


--dik3b7v4xtyfthsu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-4442-1
July 28, 2020

sympa vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in Sympa.

Software Description:
- sympa: Modern mailing list manager

Details:

Michael Kaczmarczik discovered that Sympa incorrectly handled HTTP
GET/POST requests. An attacker could possibly use this issue to insert,
edit or obtain sensitive information. (CVE-2018-1000550)

It was discovered that Sympa incorrectly handled URL parameters. An
attacker could possibly use this issue to perform XSS attacks.
(CVE-2018-1000671)

Nicolas Chatelain discovered that Sympa incorrectly handled environment
variables. An attacker could possibly use this issue with a setuid
binary and gain root privileges. (CVE-2020-10936)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
  sympa                           6.1.17~dfsg-1ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4442-1
  CVE-2018-1000550, CVE-2018-1000671, CVE-2020-10936

--dik3b7v4xtyfthsu
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECtyyz6azUy6AZBzSkGeI6zGnN/8FAl8ggmYACgkQkGeI6zGn
N//lkw/+NyuvFNZTofpERseNski126N6wHX1yqRaODpFlscwExs88mKcD16kaAoW
tNmyV5RvmcfuCQo7C3UEdyQVkpbqUf26qdwvQqP7RFYoGYbyGl5SfU499tS3pvIs
bUFBuW8de357pEedW+n5doRZ5ZfYyLK/AEecktubU7hjTpZUDDC2e5wPU4w+QCye
OME9xyKkC+Pb63FeVd4lpPFNsAeFkRH2mCZ/Fl8WG6hG5PvaV5A2dPhn8Mtaoyec
nSa5USqJZqFgMsH45E08yJ6GOqsgnA4ZW+ES/rquIVR/0VwRsw7VQ63vx1G+vRMv
6IAc1651h3Cp3owoxcsxoHfcDjj6dV46z0jHgFuay/vVy51pwic/1Hh6yS200ieR
Eaq0MKr1qJq6ITIRwuy9UNH7WSGNlQ86t0/TnHPKsSg+qjd9SNQSy5StjRydJi+V
ZOkxQfb8rB3RGI5Om1UPSG0CFq4YhOZOaAFsaEfVzPyKk+vHVlMuTYFR/+eNqHdg
ZZzcz9tjsFIdq4PVMBb5DJkCjD8goJEVIsXGpQgiRM475mJFlUfisoOj1UxZFCFs
Zk5TngdyL1YzYiz8jZM/p/uKPesT2dHdN2q+n10jkdpW9VXRZUqkl0dRzxV0NK6J
p+7xmAUm/0fdyBFxcFEcs6uScFWifabjFsXjLLhHcqeExlai8Lg=
=h/IN
-----END PGP SIGNATURE-----

--dik3b7v4xtyfthsu--


--===============4191504478460152995==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce