CVE-2006-0195: XSS

Published Feb 24, 2006

Updated

Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/" and "/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.

Affected Software

12 affected components

Squirrelmail Squirrelmail=1.4.2

Squirrelmail Squirrelmail=1.4.6_rc1

Squirrelmail Squirrelmail=1.4.3_r3

Squirrelmail Squirrelmail=1.4.3_rc1

Squirrelmail Squirrelmail=1.4.4_rc1

Squirrelmail Squirrelmail=1.4.3

Squirrelmail Squirrelmail=1.4.1

Squirrelmail Squirrelmail=1.4

Squirrelmail Squirrelmail=1.4.3a

Squirrelmail Squirrelmail=1.4_rc1

Squirrelmail Squirrelmail=1.4.4

Squirrelmail Squirrelmail=1.4.5

Event History

Feb 24, 2006

CVE Published

12:02 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0195?

CVE-2006-0195 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2006-0195?

To fix CVE-2006-0195, upgrade SquirrelMail to version 1.4.6 or later.

Which versions of SquirrelMail are affected by CVE-2006-0195?

CVE-2006-0195 affects SquirrelMail versions 1.4.0 through 1.4.5.

What types of attacks can be conducted using CVE-2006-0195?

CVE-2006-0195 allows remote attackers to execute cross-site scripting (XSS) attacks.

What specific methods can attackers use in CVE-2006-0195?

Attackers can exploit CVE-2006-0195 using invalid style sheet specifiers with comments or newlines in URL specifiers.