From SquirrelMail vulnerability report:
An issue was fixed that allowed arbitrary server-side code execution when SquirrelMail was configured to use the example "mapypalias" username mapping functionality.
Credits: Niels Teusink
Updated upstream patch (2009-05-21): http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733&view=patch
From SquirrelMail vulnerability report:
An issue was fixed that allowed an attacker to possibly steal user data by hijacking the SquirrelMail login session.
Credits: Tomas Hoger
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
A, From SquirrelMail vulnerability report (http://www.squirrelmail.org/security/issue/2009-05-08):
Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links.
Credits: Niels Teusink and Christian Balzer
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
B, From SquirrelMail vulnerability report: (http://www.squirrelmail.org/security/issue/2009-05-09):
An issue was fixed wherein input to the contrib/decryptheaders.php script was not sanitized and allowed arbitrary script execution upon submission of certain values.
Credits: Niels Teusink
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
From Squirrelmail vulnerability report:
An issue was fixed that allowed phishing and cross-site scripting (XSS) attacks to be run by surreptitious placement of content in specially-crafted emails sent to SquirrelMail users.
Credits: Luc Beurton
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13667
functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail webmail client: XSS flaws in generic options inputs, XSS flaw in the SquirrelSpell plug-in, XSS flaw in the Index Order page.
Also protection against Cross-site Request Forgery (CSRF) flaws has been added to the empty trash feature and to the Index Order page.
The CSRF flaws got a dedicated CVE identifier of CVE-2011-2753. For further information have a look at: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2011-2753
Upstream advisory: [2] http://www.squirrelmail.org/security/issue/2011-07-11
Relevant upstream patch: [3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119