Debian: DSA-1770-1 Critical: Imp4 Cross-Site Scripting Issue

CVE-2008-4182

It was discovered that imp4 suffers from a cross-site scripting (XSS)
attack via the user field in an IMAP session, which allows attackers to
inject arbitrary HTML code.

CVE-2009-0930

It was discovered that imp4 is prone to several cross-site scripting
(XSS) attacks via several vectors in the mail code allowing attackersto inject arbitrary HTML code.

For the oldstable distribution (etch), these problems have been fixed in
version 4.1.3-4etch1.

For the stable distribution (lenny), these problems have been fixed in
version 4.2-4, which was already included in the lenny release.

For the testing distribution (squeeze) and the unstable distribution
(sid), these problems have been fixed in version 4.2-4.


We recommend that you upgrade your imp4 packages.


Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get...