Multiple vulnerabilities has been found and corrected in awstats:

awstats.cgi in AWStats before 7.0 accepts a configdir parameter in
the URL, which allows remote attackers to execute arbitrary commands
via a crafted configuration file located on a (1) WebDAV server or
(2) NFS server (CVE-2010-4367).

Directory traversal vulnerability in AWStats before 7.0 allows remote
attackers to have an unspecified impact via a crafted LoadPlugin
directory (CVE-2010-4369).

The updated packages have been upgraded to the latest version to
address these vulnerabilities.