Bug 166538 - CAN-2005-1769 Multiple XSS issues in squirrelmail
CAN-2005-1769 Multiple XSS issues in squirrelmail
Product: Fedora
Classification: Fedora
Component: squirrelmail (Show other bugs)
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Warren Togami
: Security
Depends On:
  Show dependency treegraph
Reported: 2005-08-22 23:57 EDT by Mike
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-08-23 00:34:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Mike 2005-08-22 23:57:11 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.10) Gecko/20050719 Fedora/1.7.10-1.3.1

Description of problem:
See the bug listed here.  Although much of the conversation concerned FC3 that bug was closed out today when FC4 was addressed but no mention of a resolution on FC3.


The initial description was:

+++ This bug was initially created as a clone of Bug #160241 +++

We, the SquirrelMail project, plan on publicizing the attached patch
upcoming Wednesday, June 15th 2005. We're sending it here to give you
some advance notice to prepare for this if you want to. Sorry for the
short notice but this was mainly caused by the finding of some
additional issues.

- It contains fixes for several cross site scripting attacks, most by
URL manipulation, and some by sending a specially crafted HTML email.
- The attached patch is tentative; further testing or further revealed
issues may warrant changes between now and the release.
- The patch is made against the 1.4.4-release version of SquirrelMail.
- Please do not disclose information about this vulnerability until
- Credits to many of the findings go to Martijn Brinkers.

Warren built a new FC3/FC4 rpm for testing:

Please test this RPM here on FC3 or FC4.  Upstream's 1.4.5 release was screwed
and unusable, so I added everything in 1.4.6 CVS to this test package.  This
might actually allow squirrelmail to run on FC4's PHP5 too while solving the
security issues.

I know that more fixes are required before pushing this as a FC3 & FC4 update,
but your testing is required to help me figure out exactly what needs fixing.

I asked earlier today if we need to reopen the bug for FC3 but since there was no response,  I'll open a new bug just so it doesnt slip through the cracks.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Use squirrelmail

Additional info:
Comment 1 Warren Togami 2005-08-23 00:34:12 EDT
Haven't you seen the FC3 update announcement and new package in the repository?

Note You need to log in before you can comment on or make changes to this bug.