CVE-2009-1578: XSS
First published: Tue May 12 2009(Updated: )
A, From SquirrelMail vulnerability report (<a href="http://www.squirrelmail.org/security/issue/2009-05-08">http://www.squirrelmail.org/security/issue/2009-05-08</a>): Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links. Credits: Niels Teusink and Christian Balzer Patch: <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670</a> B, From SquirrelMail vulnerability report: (<a href="http://www.squirrelmail.org/security/issue/2009-05-09">http://www.squirrelmail.org/security/issue/2009-05-09</a>): An issue was fixed wherein input to the contrib/decrypt_headers.php script was not sanitized and allowed arbitrary script execution upon submission of certain values. Credits: Niels Teusink Patch: <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squirrelmail Squirrelmail | =1.3.1 | |
| Squirrelmail Squirrelmail | =0.4 | |
| Squirrelmail Squirrelmail | =1.0.6 | |
| Squirrelmail Squirrelmail | =1.0.5 | |
| Squirrelmail Squirrelmail | =0.3 | |
| Squirrelmail Squirrelmail | =0.4pre2 | |
| Squirrelmail Squirrelmail | =1.1.0 | |
| Squirrelmail Squirrelmail | =1.0pre2 | |
| Squirrelmail Squirrelmail | =0.3.1 | |
| Squirrelmail Squirrelmail | =0.1.2 | |
| Squirrelmail Squirrelmail | =1.2.7 | |
| Squirrelmail Squirrelmail | =1.0.1 | |
| Squirrelmail Squirrelmail | =0.2.1 | |
| Squirrelmail Squirrelmail | =1.4.12 | |
| Squirrelmail Squirrelmail | =1.2.0 | |
| Squirrelmail Squirrelmail | =1.2.9 | |
| Squirrelmail Squirrelmail | =0.1 | |
| Squirrelmail Squirrelmail | =1.4.15 | |
| Squirrelmail Squirrelmail | =1.2.2 | |
| Squirrelmail Squirrelmail | =0.5pre2 | |
| Squirrelmail Squirrelmail | =1.1.1 | |
| Squirrelmail Squirrelmail | =1.4.16 | |
| Squirrelmail Squirrelmail | =1.2.0_rc3 | |
| Squirrelmail Squirrelmail | =1.1.2 | |
| Squirrelmail Squirrelmail | =1.4.15_rc1 | |
| Squirrelmail Squirrelmail | ||
| Squirrelmail Squirrelmail | =0.3pre2 | |
| Squirrelmail Squirrelmail | =0.1.1 | |
| Squirrelmail Squirrelmail | =1.3.2 | |
| Squirrelmail Squirrelmail | =1.2.1 | |
| Squirrelmail Squirrelmail | =1.4.1 | |
| Squirrelmail Squirrelmail | =1.2 | |
| Squirrelmail Squirrelmail | =1.4.0_rc2a | |
| Squirrelmail Squirrelmail | =1.4.0_rc1 | |
| Squirrelmail Squirrelmail | =1.4.0 | |
| Squirrelmail Squirrelmail | =1.4 | |
| Squirrelmail Squirrelmail | =1.1.3 | |
| Squirrelmail Squirrelmail | =1.2.4 | |
| Squirrelmail Squirrelmail | =0.5pre1 | |
| Squirrelmail Squirrelmail | =1.2.3 | |
| Squirrelmail Squirrelmail | =1.4.10 | |
| Squirrelmail Squirrelmail | =1.0.2 | |
| Squirrelmail Squirrelmail | =1.0.4 | |
| Squirrelmail Squirrelmail | =1.0pre1 | |
| Squirrelmail Squirrelmail | =1.2.6 | |
| Squirrelmail Squirrelmail | =1.4.10a | |
| Squirrelmail Squirrelmail | =0.3pre1 | |
| Squirrelmail Squirrelmail | =1.2.10 | |
| Squirrelmail Squirrelmail | =0.4pre1 | |
| Squirrelmail Squirrelmail | =1.2.5 | |
| Squirrelmail Squirrelmail | =1.4.11 | |
| Squirrelmail Squirrelmail | =1.0.3 | |
| Squirrelmail Squirrelmail | =1.3.0 | |
| Squirrelmail Squirrelmail | =1.0 | |
| Squirrelmail Squirrelmail | =0.2 | |
| Squirrelmail Squirrelmail | =1.2.8 | |
| Squirrelmail Squirrelmail | =1.2.11 | |
| Squirrelmail Squirrelmail | =0.5 | |
| Squirrelmail Squirrelmail | <=1.4.17 | |
| Squirrelmail Squirrelmail | =1.0pre3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=500363
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.html
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog
- http://secunia.com/advisories/35073
- http://www.securityfocus.com/bid/34916
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.html
- http://www.squirrelmail.org/security/issue/2009-05-09
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/contrib/decrypt_headers.php?r1=13672&r2=13671&pathrev=13672
- http://www.squirrelmail.org/security/issue/2009-05-08
- http://www.vupen.com/english/advisories/2009/1296
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/global.php?r1=13670&r2=13669&pathrev=13670
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
- http://secunia.com/advisories/35052
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:110
- http://www.debian.org/security/2009/dsa-1802
- http://secunia.com/advisories/35140
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.html
- http://www.redhat.com/support/errata/RHSA-2009-1066.html
- https://gna.org/forum/forum.php?forum_id=2146
- http://www.vupen.com/english/advisories/2009/3315
- http://secunia.com/advisories/37415
- http://osvdb.org/60468
- http://download.gna.org/nasmail/nasmail-1.7.zip
- http://secunia.com/advisories/35259
- http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
- http://secunia.com/advisories/40220
- http://support.apple.com/kb/HT4188
- http://www.vupen.com/english/advisories/2010/1481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50460
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50459
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11624
- http://admin.fedoraproject.org/updates/squirrelmail-1.4.18-1.fc9
- http://example.com
- https://rhn.redhat.com/errata/RHSA-2009-1066.html
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-historical
- collector/nvd-index
- collector/redhat-bugzilla
- alias/CVE-2009-1578
- vendor/squirrelmail
- canonical/squirrelmail squirrelmail
- version/squirrelmail squirrelmail/1.3.1
- version/squirrelmail squirrelmail/0.4
- version/squirrelmail squirrelmail/1.0.6
- version/squirrelmail squirrelmail/1.0.5
- version/squirrelmail squirrelmail/0.3
- version/squirrelmail squirrelmail/0.4pre2
- version/squirrelmail squirrelmail/1.1.0
- version/squirrelmail squirrelmail/1.0pre2
- version/squirrelmail squirrelmail/0.3.1
- version/squirrelmail squirrelmail/0.1.2
- version/squirrelmail squirrelmail/1.2.7
- version/squirrelmail squirrelmail/1.0.1
- version/squirrelmail squirrelmail/0.2.1
- version/squirrelmail squirrelmail/1.4.12
- version/squirrelmail squirrelmail/1.2.0
- version/squirrelmail squirrelmail/1.2.9
- version/squirrelmail squirrelmail/0.1
- version/squirrelmail squirrelmail/1.4.15
- version/squirrelmail squirrelmail/1.2.2
- version/squirrelmail squirrelmail/0.5pre2
- version/squirrelmail squirrelmail/1.1.1
- version/squirrelmail squirrelmail/1.4.16
- version/squirrelmail squirrelmail/1.2.0_rc3
- version/squirrelmail squirrelmail/1.1.2
- version/squirrelmail squirrelmail/1.4.15_rc1
- version/squirrelmail squirrelmail/0.3pre2
- version/squirrelmail squirrelmail/0.1.1
- version/squirrelmail squirrelmail/1.3.2
- version/squirrelmail squirrelmail/1.2.1
- version/squirrelmail squirrelmail/1.4.1
- version/squirrelmail squirrelmail/1.2
- version/squirrelmail squirrelmail/1.4.0_rc2a
- version/squirrelmail squirrelmail/1.4.0_rc1
- version/squirrelmail squirrelmail/1.4.0
- version/squirrelmail squirrelmail/1.4
- version/squirrelmail squirrelmail/1.1.3
- version/squirrelmail squirrelmail/1.2.4
- version/squirrelmail squirrelmail/0.5pre1
- version/squirrelmail squirrelmail/1.2.3
- version/squirrelmail squirrelmail/1.4.10
- version/squirrelmail squirrelmail/1.0.2
- version/squirrelmail squirrelmail/1.0.4
- version/squirrelmail squirrelmail/1.0pre1
- version/squirrelmail squirrelmail/1.2.6
- version/squirrelmail squirrelmail/1.4.10a
- version/squirrelmail squirrelmail/0.3pre1
- version/squirrelmail squirrelmail/1.2.10
- version/squirrelmail squirrelmail/0.4pre1
- version/squirrelmail squirrelmail/1.2.5
- version/squirrelmail squirrelmail/1.4.11
- version/squirrelmail squirrelmail/1.0.3
- version/squirrelmail squirrelmail/1.3.0
- version/squirrelmail squirrelmail/1.0
- version/squirrelmail squirrelmail/0.2
- version/squirrelmail squirrelmail/1.2.8
- version/squirrelmail squirrelmail/1.2.11
- version/squirrelmail squirrelmail/0.5
- version/squirrelmail squirrelmail/1.4.17
- version/squirrelmail squirrelmail/1.0pre3