Red Hat Security AdvisoryRHSA-2006:0283
squirrelmail security update
Released 2006-05-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 squirrelmail-1.4.6-5.el3
- Red Hat Enterprise Linux AS version 3 squirrelmail-1.4.6-5.el3
- Red Hat Enterprise Linux AS version 4 squirrelmail-1.4.6-5.el4
- Red Hat Enterprise Linux Desktop version 4 squirrelmail-1.4.6-5.el4
- Red Hat Enterprise Linux ES version 3 squirrelmail-1.4.6-5.el3
- Red Hat Enterprise Linux ES version 4 squirrelmail-1.4.6-5.el4
- Red Hat Enterprise Linux WS version 3 squirrelmail-1.4.6-5.el3
- Red Hat Enterprise Linux WS version 4 squirrelmail-1.4.6-5.el4
Fixes 3 records
Priority LOW 27
CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP inject…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02351 · Published 2006-02-24 · Fixed
Priority LOW 24
Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.02083 · Published 2006-02-24 · Fixed
Priority LOW 24
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0205 · Published 2006-02-24 · Fixed
