Ubuntu Security Notice 285-1: AWStats did not properly sanitize the ‘migrate’ CGI parameter. If the update of the stats via web front-end is allowed, a remote attacker could execute arbitrary commands on the server with the privileges of the AWStats server.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/46713/USN-285-1.txt
Source: https://packetstormsecurity.com/files/46713/Ubuntu-Security-Notice-285-1.html