Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) deletedraft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element.
Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.
From SquirrelMail vulnerability report:
An issue was fixed that allowed an attacker to possibly steal user data by hijacking the SquirrelMail login session.
Credits: Tomas Hoger
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail webmail client: XSS flaws in generic options inputs, XSS flaw in the SquirrelSpell plug-in, XSS flaw in the Index Order page.
Also protection against Cross-site Request Forgery (CSRF) flaws has been added to the empty trash feature and to the Index Order page.
The CSRF flaws got a dedicated CVE identifier of CVE-2011-2753. For further information have a look at: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2011-2753
Upstream advisory: [2] http://www.squirrelmail.org/security/issue/2011-07-11
Relevant upstream patch: [3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username.
References: [1] http://www.squirrelmail.org/security/issue/2010-07-23
Upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?view=patch&r1=13972&r2=13971&pathrev=13972
Affected Versions: <= v1.4.20
Register Globals: Registerglobals does not have to be on for this issue.
Credit: Issue discovered by Mikhail Goriachev