|Category:||Debian Local Security Checks|
|Title:||Debian Security Advisory DSA 2291-1 (squirrelmail)|
|Summary:||Debian Security Advisory DSA 2291-1 (squirrelmail)|
The remote host is missing an update to squirrelmail
announced via advisory DSA 2291-1.
Various vulnerabilities have been found in SquirrelMail, a webmail
application. The Common Vulnerabilities and Exposures project
identifies the following vulnerabilities:
SquirrelMail did not prevent page rendering inside a third-party
HTML frame, which makes it easier for remote attackers to conduct
clickjacking attacks via a crafted web site.
CVE-2010-4555, CVE-2011-2752, CVE-2011-2753
Multiple small bugs in SquirrelMail allowed an attacker to inject
malicious script into various pages or alter the contents of user
It was possible to inject arbitrary web script or HTML via a
crafted STYLE element in an HTML part of an e-mail message.
For the oldstable distribution (lenny), this problem has been fixed in
For the stable distribution (squeeze), this problem has been fixed in
For the testing (wheezy) and unstable distribution (sid), these problems
have been fixed in version 1.4.22-1.
We recommend that you upgrade your squirrelmail packages.
Common Vulnerability Exposure (CVE) ID: CVE-2010-4554|
Debian Security Information: DSA-2291 (Google Search)
RedHat Security Advisories: RHSA-2012:0103
XForce ISS Database: squirrelmail-http-clickjacking(68512)
Common Vulnerability Exposure (CVE) ID: CVE-2010-4555
XForce ISS Database: squirrelmail-dropdown-xss(68510)
XForce ISS Database: squirrelmail-spellchecking-xss(68511)
Common Vulnerability Exposure (CVE) ID: CVE-2011-2023
Common Vulnerability Exposure (CVE) ID: CVE-2011-2752
XForce ISS Database: squirrelmail-newline-crlf-injection(68587)
Common Vulnerability Exposure (CVE) ID: CVE-2011-2753
XForce ISS Database: squirrelmail-authentication-csrf(68586)
|Copyright||Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com|
|This is only one of 58962 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.