REDHAT-BUG-500363: XSS
First published: Tue May 12 2009(Updated: )
A, From SquirrelMail vulnerability report (<a href="http://www.squirrelmail.org/security/issue/2009-05-08">http://www.squirrelmail.org/security/issue/2009-05-08</a>): Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links. Credits: Niels Teusink and Christian Balzer Patch: <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670</a> B, From SquirrelMail vulnerability report: (<a href="http://www.squirrelmail.org/security/issue/2009-05-09">http://www.squirrelmail.org/security/issue/2009-05-09</a>): An issue was fixed wherein input to the contrib/decrypt_headers.php script was not sanitized and allowed arbitrary script execution upon submission of certain values. Credits: Niels Teusink Patch: <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SquirrelMail |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.squirrelmail.org/security/issue/2009-05-08
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
- http://www.squirrelmail.org/security/issue/2009-05-09
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
- http://admin.fedoraproject.org/updates/squirrelmail-1.4.18-1.fc9
- http://example.com
- https://rhn.redhat.com/errata/RHSA-2009-1066.html
- https://bugzilla.redhat.com/show_bug.cgi?id=500363
Frequently Asked Questions
What is the severity of REDHAT-BUG-500363?
The severity of REDHAT-BUG-500363 is considered high due to the potential for cross-site scripting (XSS) attacks.
How do I fix REDHAT-BUG-500363?
To fix REDHAT-BUG-500363, ensure that you are using the latest version of SquirrelMail that addresses these vulnerabilities.
What vulnerability type is associated with REDHAT-BUG-500363?
REDHAT-BUG-500363 is associated with a cross-site scripting (XSS) vulnerability.
Which software is affected by REDHAT-BUG-500363?
SquirrelMail is the affected software in REDHAT-BUG-500363.
What attacks can REDHAT-BUG-500363 enable?
REDHAT-BUG-500363 can enable attackers to execute arbitrary scripts on SquirrelMail pages.
- collector/redhat-bugzilla
- alias/CVE-2009-1578
- agent/type
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/squirrelmail
- canonical/squirrelmail