Red Hat Security AdvisoryRHSA-2007:0358
squirrelmail security update
Released 2007-05-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 squirrelmail-1.4.8-6.el3
- Red Hat Enterprise Linux (v. 5 server) squirrelmail-1.4.8-4.0.1.el5
- Red Hat Enterprise Linux AS version 3 squirrelmail-1.4.8-6.el3
- Red Hat Enterprise Linux AS version 4 squirrelmail-1.4.8-4.0.1.el4
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) squirrelmail-1.4.8-4.0.1.el5
- Red Hat Enterprise Linux Desktop version 4 squirrelmail-1.4.8-4.0.1.el4
- Red Hat Enterprise Linux ES version 3 squirrelmail-1.4.8-6.el3
- Red Hat Enterprise Linux ES version 4 squirrelmail-1.4.8-4.0.1.el4
- Red Hat Enterprise Linux WS version 3 squirrelmail-1.4.8-6.el3
- Red Hat Enterprise Linux WS version 4 squirrelmail-1.4.8-4.0.1.el4
Fixes 2 records
Priority LOW 26
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01374 · Published 2007-05-11 · Fixed CWE-352
Priority LOW 25
Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0253 · Published 2007-05-11 · Fixed CWE-79
