Bug 378811 – <mail-client/squirrelmail-1.4.22: Multiple vulnerabilities (CVE-2010-{4554,4555},CVE-2011-{2023,2752,2753})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2011-08-11 17:55:27 UTC]

CVE-2011-2753 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2753):
  Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail
  1.4.21 and earlier allow remote attackers to hijack the authentication of
  unspecified victims via vectors involving (1) the empty trash implementation
  and (2) the Index Order (aka options_order) page, a different issue than
  CVE-2010-4555.

CVE-2011-2752 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2752):
  CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows
  remote attackers to modify or add preference values via a \n (newline)
  character, a different vulnerability than CVE-2010-4555.

CVE-2011-2023 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2023):
  Cross-site scripting (XSS) vulnerability in functions/mime.php in
  SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web
  script or HTML via a crafted STYLE element in an e-mail message.

CVE-2010-4555 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4555):
  Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21
  and earlier allow remote attackers to inject arbitrary web script or HTML
  via vectors involving (1) drop-down selection lists, (2) the > (greater
  than) character in the SquirrelSpell spellchecking plugin, and (3) errors
  associated with the Index Order (aka options_order) page.

CVE-2010-4554 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4554):
  functions/page_header.php in SquirrelMail 1.4.21 and earlier does not
  prevent page rendering inside a frame in a third-party HTML document, which
  makes it easier for remote attackers to conduct clickjacking attacks via a
  crafted web site.


net-mail, can we stable 1.4.22?

[Comment 1 Eray Aslan 2011-08-11 18:44:38 UTC]

(In reply to comment #0)
> net-mail, can we stable 1.4.22?

Yes, we should stabilize =mail-client/squirrelmail-1.4.22.  Thank you.

[Comment 2 Tim Sammut (RETIRED) 2011-08-17 18:37:20 UTC]

(In reply to comment #1)
> (In reply to comment #0)
> > net-mail, can we stable 1.4.22?
> 
> Yes, we should stabilize =mail-client/squirrelmail-1.4.22.  Thank you.

Great, thanks.

Arches, please test and mark stable:
=mail-client/squirrelmail-1.4.22
Target keywords : "alpha amd64 ppc ppc64 sparc x86"

[Comment 3 Agostino Sarubbo 2011-08-18 09:15:32 UTC]

amd64 ok

bug 379629 already fixed =)

[Comment 4 Tony Vroon (RETIRED) 2011-08-18 10:14:23 UTC]

+  18 Aug 2011; Tony Vroon <[e-mail]> squirrelmail-1.4.22.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo in
+  security bug #378811.

[Comment 5 Kacper Kowalik (Xarthisius) (RETIRED) 2011-08-18 16:59:41 UTC]

ppc/ppc64 stable

[Comment 6 Paweł Hajdan, Jr. (RETIRED) 2011-08-20 04:21:56 UTC]

x86 stable

[Comment 7 Raúl Porcel (RETIRED) 2011-08-27 17:40:45 UTC]

alpha/sparc stable

[Comment 8 Tim Sammut (RETIRED) 2011-08-28 02:11:28 UTC]

Thanks, folks. GLSA Vote: yes.

[Comment 9 Stefan Behte (RETIRED) 2011-10-08 21:17:49 UTC]

Vote: NO.

[Comment 10 Tobias Heinlein (RETIRED) 2011-10-08 21:23:53 UTC]

No too, closing [noglsa].