Bugzilla Bug 156949

From:     kink@squirrelmail.org
Subject:        [SM-ANNOUNCE] SquirrelMail 1.4.9 Released
Date:   December 2, 2006 10:48:45 AM EST
To:       squirrelmail-announce@lists.sourceforge.net   Cc:      
squirrelmail-plugins@lists.sourceforge.net,
squirrelmail-users@lists.sourceforge.net,
squirrelmail-devel@lists.sourceforge.net

Hello All,

The SquirrelMail Project Team is proud to announce the release of
SquirrelMail 1.4.7. This version is a maintenance release, addressing
the following problems since 1.4.6:
- Some security fixes (see below)
- Small enhancements
- A collection of bugfixes (see ChangeLog)

Security issues
===============

This release addresses security issues found since the release of 1.4.8:

Cross site scripting via malicious input the mailto parameter of
webmail.php, the session and delete_draft parameters of compose.php and
via a shortcoming in the magicHTML filter.

This is CVE-2006-6142. Thanks for Martijn Brinkers for his continued
research that uncovered these issues.

We've also changed SquirrelMail attachment handling to work around an
issue in Internet Explorer: the browser will attempt to guess the MIME
type of attachments based on content, not the MIME header we send.
Attachments could fake to be an 'harmless' image/jpeg, while they were
in fact HTML that Internet Explorer would render.

Further details on SquirrelMail vulnerabilities can be found at the
following address:

  http://www.squirrelmail.org/security/

We strongly encourage any persons uncovering security issues to
contact the SquirrelMail team via security <at> squirrelmail.org.

Package md5sums
===============

b3dc6e3c5accb9b88bf6ebfd87336b96  squirrelmail-1.4.9.tar.bz2
5a3ecbda6d8378c68fa40b4ac5b2d487  squirrelmail-1.4.9.tar.gz
875848f25d481b59552d4e93aaacba4c  squirrelmail-1.4.9.zip


Download at:

  http://www.squirrelmail.org/download.php

Happy SquirrelMailing!

-- 
Thijs Kinkhorst
SquirrelMail Project Team

thanks for filing this, eraidcator please provide new packages blablaa (guess
you already know that ;)

From:     marc@squirrelmail.org
Subject:        [SM-ANNOUNCE] SquirrelMail 1.4.9a Released
Date:   December 3, 2006 8:25:21 PM EST
To:       squirrelmail-announce@lists.sourceforge.net
Cc:       squirrelmail-devel@lists.sourceforge.net,
squirrelmail-users@lists.sourceforge.net,
squirrelmail-plugins@lists.sourceforge.net

Hello All,

The SquirrelMail Project Team is proud to announce the release of
SquirrelMail 1.4.9a. This version is a security release.

The day after we released SquirrelMail 1.4.9 new cross site scripting
issues were reported and immediately fixed. Therefor the decision to
release 1.4.9a so short after the 1.4.9 release.

1.4.9 and 1.4.9a is addressing
the following problems since 1.4.8:
- Some security fixes (see below)
- Small enhancements
- A collection of bugfixes (see ChangeLog)

Security issues
===============
This release addresses security issues found since the release of 1.4.8:

Cross site scripting via malicious input the mailto parameter of
webmail.php, the session and delete_draft parameters of compose.php and
via a shortcoming in the magicHTML filter.

This is CVE-2006-6142. Thanks for Martijn Brinkers for his continued research
that uncovered these issues.

We've also changed SquirrelMail attachment handling to work around an issue
in Internet Explorer: the browser will attempt to guess the MIME type of
attachments based on content, not the MIME header we send. Attachments could
fake to be an 'harmless' image/jpeg, while they were in fact HTML that
Internet Explorer would render.

After release 1.4.9 Martijn Brinkers again discovered new cross site
scripting issues in the magicHtml filter. The new discovered security issues
have to do with the wide intepretation of the words expression and url by IE
browsers. As second issue Martijn Brinkers that the @import statement in
stylesheets could be misused.

Further details on SquirrelMail vulnerabilities can be found at the
following address:

  http://www.squirrelmail.org/security/


Package md5sums
===============

3adf66bfe2e816ba8375cf811d8ef3f6 squirrelmail-1.4.9a.tar.bz2
5b19f8cc5badef91d1f2410df41564bc squirrelmail-1.4.9a.tar.gz
a9e108418b0a42763a1d29a267fa7168 squirrelmail-1.4.9a.zip


Download at:

  http://www.squirrelmail.org/download.php

Happy SquirrelMailing!

-- 
Marc Groot Koerkamp
SquirrelMail Project Team

As Jeremy is still MIA, I took the liberty of bumping squirrelmail to 1.4.9a.

I have also marked it stable on x86, as I only tested it on a stable box, where
I have a working squirrelmail installation.

Arches,

test and mark mail-client/squirrelmail-1.4.9a stable if possible please

x86 and sparc already done. Removing.

ppc stable

Stable on Alpha.

ppc64 stable

amd64 stable

I vote no

i'm actually the only active member of the security team, so let's close this
without GLSA. Feel free to reopen if you disagree.

This was marked as closed but was never fixed for ~arch.  1.5.1-r4 contains the
fix.