Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 10: FEDORA-2009-4880 Critical SquirrelMail Code Injection Fix

fedora
Calendar Grey May 12, 2009
Dist Fedora Esm H88
The recent MailApp enhancement introduces compatibility for unverified 32bit UID entries in Ubuntu 20.04, tackling multiple vulnerabilities.
squirrelmail is now able to work with unsigned 32bit UID values with 32-bit version of php

Summary

SquirrelMail is a basic webmail package written in PHP4. It

includes built-in pure PHP support for the IMAP and SMTP protocols, and

all pages render in pure HTML 4.0 (with no Javascript) for maximum

compatibility across browsers. It has very few requirements and is very

easy to configure and install.

Update Information:

squirrelmail is now able to work with unsigned 32bit UID values with 32-bit version of php

Topics%20covered

Topics Covered

security advisory software update Fedora cross site scripting SquirrelMail code injection session fixation

Change Log

* Tue May 12 2009 Michal Hlavinka - 1.4.18-1 - updated to 1.4.18 * Wed Mar 18 2009 Michal Hlavinka - 1.4.17-4 - don't use white text (invisible on white paper) for highlighting in conf.pl (#427217) * Tue Mar 17 2009 Michal Hlavinka - 1.4.17-3 - dont use colors in conf.pl by default (#427217) * Thu Dec 4 2008 Michal Hlavinka - 1.4.17-2 - add missing locales * Thu Dec 4 2008 Michal Hlavinka - 1.4.17-1 - update to 1.4.17 (fixes CVE-2008-2379)

References


[ 1 ] Bug #500360 - CVE-2009-1579 SquirrelMail: Server-side code injection in map_yp_alias username map https://bugzilla.redhat.com/show_bug.cgi?id=500360 [ 2 ] Bug #500358 - CVE-2009-1580 SquirrelMail: Session fixation vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=500358 [ 3 ] Bug #500356 - CVE-2009-1581 SquirrelMail: CSS positioning vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=500356 [ 4 ] Bug #500363 - CVE-2009-1578 SquirrelMail: Multiple cross site scripting issues https://bugzilla.redhat.com/show_bug.cgi?id=500363

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update squirrelmail' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: squirrelmail
Product: Fedora 10
Version: 1.4.18
Release: 1.fc10
URL: https://www.squirrelmail.org/
Summary: SquirrelMail webmail client

Topics%20covered

Topics Covered

security advisory software update Fedora cross site scripting SquirrelMail code injection session fixation

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here