Red Hat Security Advisory

RHSA-2012:0103

squirrelmail security update

Released 2012-02-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) squirrelmail-1.4.8-5.el5_7.13
Red Hat Enterprise Linux (v. 5 server) squirrelmail-1.4.8-5.el5_7.13
Red Hat Enterprise Linux AS version 4 squirrelmail-1.4.8-18.el4
Red Hat Enterprise Linux Desktop version 4 squirrelmail-1.4.8-18.el4
Red Hat Enterprise Linux ES version 4 squirrelmail-1.4.8-18.el4
Red Hat Enterprise Linux WS version 4 squirrelmail-1.4.8-18.el4

Fixes 7 records

TI-2010-01580 CVE-2010-1637 · GHSA-79mr-p6x2-hw9g

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated…

LOW 34

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02676 Published 2010-06-22 Fixed CWE-918

TI-2011-02412 CVE-2011-2753 · GHSA-r7jq-728g-6qg5

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and…

LOW 32

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implement…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01081 Published 2011-07-17 Fixed CWE-352

TI-2011-02411 CVE-2011-2752 · GHSA-82v9-gcgx-xxxv

CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers…

LOW 30

CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01935 Published 2011-07-17 Fixed CWE-94

TI-2010-02689 CVE-2010-2813 · GHSA-4jqc-6m5c-wg7v

functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit…

LOW 30

functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login att…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04048 Published 2010-08-19 Fixed CWE-399

TI-2011-01787 CVE-2011-2023 · GHSA-p9fx-gwhc-6m8m

Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before…

LOW 25

Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02324 Published 2011-07-14 Fixed CWE-79

TI-2010-04285 CVE-2010-4555 · GHSA-cwvc-h2j5-j87h

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02348 Published 2011-07-14 Fixed CWE-79

TI-2010-04284 CVE-2010-4554 · GHSA-f68p-8hwp-w826

functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page…

LOW 24

functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01807 Published 2011-07-14 Fixed CWE-20