Bug 722831 - (CVE-2011-2752) CVE-2011-2752 SquirrelMail: CRLF injection vulnerability
CVE-2011-2752 SquirrelMail: CRLF injection vulnerability
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
public=20110711,reported=20110717,sou...
: Security
Depends On: 737980 737981 737982 833983
Blocks: 720699
  Show dependency treegraph
 
Reported: 2011-07-18 03:35 EDT by Jan Lieskovsky
Modified: 2012-06-20 10:39 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-02-08 23:48:30 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2011-07-18 03:35:48 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-2752 to
the following vulnerability:

CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows
remote attackers to modify or add preference values via a \n (newline)
character, a different vulnerability than CVE-2010-4555.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2752
[2] http://www.squirrelmail.org/security/issue/2011-07-11

Upstream patch:
[3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119

from which the following subpart:
[4] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/options.php?view=patch&r1=14084&r2=14119&pathrev=14119

applies to newlines fix in selection list widgets.
Comment 1 Jan Lieskovsky 2011-07-18 03:41:33 EDT
This issue affects the versions of the squirrelmail package, as shipped with
Red Hat Enterprise Linux 4 and 5.

--

This issue does not affect the version of the squirrelmail package, as present
within EPEL-6 repository. Relevant package update has been already performed.

--

This issue does not affect the versions of the squirrelmail package, as shipped with Fedora release of 14 and 15. Squirrelmail package updates has been already scheduled (squirrelmail-1.4.22-2.fc14, squirrelmail-1.4.22-2.fc15) and once they have passed the required testing, they will be pushed to particular Fedora stable repository.
Comment 3 errata-xmlrpc 2012-02-08 14:47:55 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2012:0103 https://rhn.redhat.com/errata/RHSA-2012-0103.html

Note You need to log in before you can comment on or make changes to this bug.