Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 58020 - mail-mta/courier XSS in sqwebmail
Summary: mail-mta/courier XSS in sqwebmail
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High minor (vote)
Assignee: Gentoo Security
URL: http://cve.mitre.org/cgi-bin/cvename....
Whiteboard: C3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2004-07-22 23:54 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2011-10-30 22:37 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2004-07-22 23:54:48 UTC 
After a bit more investigation we apparently have sqwebmail in portage in mail-mta/courier. 

Initial posting here:

http://marc.theaimsgroup.com/?l=bugtraq&m=108786212220140&w=2
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2004-07-23 02:35:27 UTC 
sqwebmail is fixed on version 4.0.5 (June 10)
We have courier 0.45.6 (June 10) and 0.45.6.20040618 as ~ in the tree. I suppose they contain the fix, in which case we would just need to stable-ize and GLSA.

Maintainer: please confirm.
Comment 2 Thierry Carrez (RETIRED) gentoo-dev 2004-07-28 01:44:31 UTC 
Confirmed 0.45.6.20040618 contains sqwebmail 4.0.5, so it's fixed.
alpha,ppc,x86,sparc : please test and mark that version stable.
Comment 3 Gustavo Zacarias (RETIRED) gentoo-dev 2004-07-29 07:34:42 UTC 
Sparc stable, sorry for the delay.
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2004-08-03 07:58:54 UTC 
Package stable-d by maintainer.
Ready for a GLSA
Comment 5 Thierry Carrez (RETIRED) gentoo-dev 2004-08-04 08:53:11 UTC 
GLSA 200408-02