Red Hat Security AdvisoryRHSA-2009:0010
squirrelmail security update
Released 2009-01-12 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 squirrelmail-1.4.8-8.el3
- Red Hat Enterprise Linux (v. 5 server) squirrelmail-1.4.8-5.el5_2.2
- Red Hat Enterprise Linux AS version 3 squirrelmail-1.4.8-8.el3
- Red Hat Enterprise Linux AS version 4 squirrelmail-1.4.8-5.el4_7.2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) squirrelmail-1.4.8-5.el5_2.2
- Red Hat Enterprise Linux Desktop version 4 squirrelmail-1.4.8-5.el4_7.2
- Red Hat Enterprise Linux ES version 3 squirrelmail-1.4.8-8.el3
- Red Hat Enterprise Linux ES version 4 squirrelmail-1.4.8-5.el4_7.2
- Red Hat Enterprise Linux WS version 3 squirrelmail-1.4.8-8.el3
- Red Hat Enterprise Linux WS version 4 squirrelmail-1.4.8-5.el4_7.2
Fixes 2 records
Priority LOW 27
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02159 · Published 2008-09-24 · Fixed CWE-310
Priority LOW 24
Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01776 · Published 2008-12-05 · Fixed CWE-79
