Red Hat Security AdvisoryRHSA-2009:0057
squirrelmail security update
Released 2009-01-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 squirrelmail-1.4.8-9.el3
- Red Hat Enterprise Linux (v. 5 server) squirrelmail-1.4.8-5.el5_2.3
- Red Hat Enterprise Linux AS version 3 squirrelmail-1.4.8-9.el3
- Red Hat Enterprise Linux AS version 4 squirrelmail-1.4.8-5.el4_7.3
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) squirrelmail-1.4.8-5.el5_2.3
- Red Hat Enterprise Linux Desktop version 4 squirrelmail-1.4.8-5.el4_7.3
- Red Hat Enterprise Linux ES version 3 squirrelmail-1.4.8-9.el3
- Red Hat Enterprise Linux ES version 4 squirrelmail-1.4.8-5.el4_7.3
- Red Hat Enterprise Linux WS version 3 squirrelmail-1.4.8-9.el3
- Red Hat Enterprise Linux WS version 4 squirrelmail-1.4.8-5.el4_7.3
Fixes 2 records
Priority LOW 32
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic ci…
CVSS 2.0MEDIUM 6.5· Network · Low privileges · Interaction — · EPSS 0.01675 · Published 2009-01-21 · Fixed CWE-287
Priority LOW 30
Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie.
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.01855 · Published 2009-05-14 · Fixed CWE-287
