CVE-2020-26932

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.debian.org/971904Vendor Advisory
https://salsa.debian.org/sympa-team/sympa/-/merge_requests/1Mailing List, Vendor Advisory
https://www.debian.org/security/2020/dsa-4818Vendor Advisory
https://bugs.debian.org/971904Vendor Advisory
https://salsa.debian.org/sympa-team/sympa/-/merge_requests/1Mailing List, Vendor Advisory
https://www.debian.org/security/2020/dsa-4818Vendor Advisory

Timeline

Published: Oct 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269336.0Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Acc CVE-2020-269346.1phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.CVE-2020-269359.8An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in CVE-2020-269368.8Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.CVE-2020-269387.2In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token CVE-2020-269395.3In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent CVE-2020-26943.1Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2020-269415.5A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of an CVE-2020-269429.1An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a CVE-2020-269439.9An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horiz CVE-2020-269449.8An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the CVE-2020-269458.1MyBatis before 3.5.6 mishandles deserialization of object streams.