REDHAT-BUG-720695: XSS

Published Jul 12, 2011

Updated

An cross-site scripting (XSS) flaw was found in the way SquirrelMail performed sanitization of MIME messages containing certain <style> HTML tags. A remote attacker could provide a specially-crafted message, which once opened in SquirrelMail webmail client could lead to arbitrary JavaScript or HTML code execution.

Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-10

Relevant patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14121

Affected Software

1 affected component

Squirrelmail Squirrelmail

Event History

Jul 12, 2011

Data Sourced

via Red Hat·02:21 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-720695?

The vulnerability REDHAT-BUG-720695 is classified as a cross-site scripting (XSS) flaw which can lead to significant security risks for users.

How do I fix REDHAT-BUG-720695?

To fix REDHAT-BUG-720695, update to the latest version of SquirrelMail that includes the security patch addressing this XSS vulnerability.

Who is affected by REDHAT-BUG-720695?

Users of SquirrelMail are primarily affected by REDHAT-BUG-720695 due to improper sanitization of MIME messages.

What type of attack does REDHAT-BUG-720695 enable?

REDHAT-BUG-720695 enables remote attackers to execute arbitrary JavaScript code through specially-crafted messages.

When was REDHAT-BUG-720695 disclosed?

REDHAT-BUG-720695 was disclosed on July 10, 2011.