A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

Several HTML filtering bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail. (CVE-2007-1262)

Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted HTML e-mail message.
(CVE-2007-2589)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

This update of squirrelmail fixes two cross-site-scripting vulnerabilities that can be used by an attacker to read opened emails (CVE-2007-1262) and to send email on behalf of the user (CVE-2007-2589).

This is a reissue of the previous update due to regressions.

Several HTML filtering bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail. (CVE-2007-1262)

Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted HTML e-mail message.
(CVE-2007-2589)

The SquirrelMail developers report :

Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

From Red Hat Security Advisory 2007:0358 :

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

Several HTML filtering bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail. (CVE-2007-1262)

Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted HTML e-mail message.
(CVE-2007-2589)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

This update of squirrelmail fixes two cross-site-scripting vulnerabilities that can be used by an attacker to read opened emails (CVE-2007-1262) and to send email on behalf of the user (CVE-2007-2589).

It was discovered that the webmail package Squirrelmail performs insufficient sanitising inside the HTML filter, which allows the injection of arbitrary web script code during the display of HTML email messages.

ID	Name	Product	Family	Published	Updated	Severity
25270	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2007:0358)	Nessus	Red Hat Local Security Checks	5/20/2007	1/14/2021	medium
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	8/2/2007	5/28/2024	critical
27458	openSUSE 10 Security Update : squirrelmail (squirrelmail-3944)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
60185	Scientific Linux Security Update : squirrelmail on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
25257	CentOS 3 / 4 / 5 : squirrelmail (CESA-2007:0358)	Nessus	CentOS Local Security Checks	5/20/2007	1/4/2021	medium
25305	FreeBSD : squirrelmail -- XSS in HTML filter (0e575ed3-0764-11dc-a80b-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	5/25/2007	1/6/2021	medium
67501	Oracle Linux 3 / 4 / 5 : squirrelmail (ELSA-2007-0358)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
27457	openSUSE 10 Security Update : squirrelmail (squirrelmail-3629)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
25227	Debian DSA-1290-1 : squirrelmail - missing input sanitising	Nessus	Debian Local Security Checks	5/16/2007	1/4/2021	medium

Detections

Analytics

Plugins Search

medium

critical

medium

medium

medium

medium

medium

medium

medium