UbuntuUpdates.org


hardyintrepidjauntykarmicstabletesting

Package squirrelmail

Name: squirrelmail

Description:

Webmail for nuts
SquirrelMail is a standards-based webmail package written in PHP. It
includes built-in pure PHP support for the IMAP and SMTP protocols, and
is designed for maximum compatibility across browsers. SquirrelMail has
few requirements and is easy to configure and install. It runs on top of
any IMAP server.

SquirrelMail has all the functionality you would want from an email client,
including strong MIME support, address books and folder manipulation.
Latest version: 2:1.4.19-1ubuntu0.1
Ubuntu release: karmic
Level: security
Repository: universe

See all versions of this package in all Ubuntu releases and repositories.


Change Log

Version: 2:1.4.19-1ubuntu0.1 2010-02-08 22:02:03 UTC 
squirrelmail (2:1.4.19-1ubuntu0.1) karmic-security; urgency=low

  * SECURITY UPDATE: (LP: #446838)
  * Multiple cross-site request forgery (CSRF) in all
    forms submissions
  * edited:
    src/addrbook_search_html.php,src/addressbook.php,src/compose.php
    src/folders_create.php,src/folders_delete.php,src/folders.php,
    src/folders_rename_do.php,src/folders_rename_getname.php,
    src/folders_subscribe.php,functions/forms.php,
    functions/mailbox_display.php,src/move_messages.php,
    src/options_highlight.php,src/options_identities.php,
    src/options_order.php,src/options.php,src/search.php,
    functions/strings.php,src/vcard.php
  * Fixes : CVE-2009-2964
    - http://www.squirrelmail.org/security/issue/2009-08-12
    - patches taken from upstream rev 13818
    - patches applied inline

 -- Leonel Nunez   Sun, 11 Oct 2009 19:18:52 -0600
446838 squirrelmail: "Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier"
CVE-2009-2964 Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijac


About   -   Changelog