UbuntuUpdates.org


AllMaverickLucidKarmicJauntyIntrepidHardyAll PPAs
Recent Search QueriesSearch Statistics

Package squirrelmail

Name: squirrelmail

Description:

Webmail for nuts
SquirrelMail is a standards-based webmail package written in PHP. It
includes built-in pure PHP support for the IMAP and SMTP protocols, and
is designed for maximum compatibility across browsers. SquirrelMail has
few requirements and is easy to configure and install. It runs on top of
any IMAP server.

SquirrelMail has all the functionality you would want from an email client,
including strong MIME support, address books and folder manipulation.
Latest version: 2:1.4.19-1ubuntu0.2
Ubuntu release: karmic (9.10)
Level: updates
Repository: universe

All versions of squirrelmail in Karmic

updates (this page) base security proposed
2:1.4.19-1ubuntu0.2 2:1.4.19-1 2:1.4.19-1ubuntu0.2 2:1.4.19-1ubuntu0.1

See all versions of squirrelmail in all Ubuntu releases and repositories.

Links

Change Log

Version: 2:1.4.19-1ubuntu0.2 2010-07-07 19:03:10 UTC 
squirrelmail (2:1.4.19-1ubuntu0.2) karmic-security; urgency=low

  * SECURITY UPDATE: (LP: #598077)
  * The Mail Fetch plugin allows remote authenticated users to bypass firewall
    restrictions and use SquirrelMail as a proxy to scan internal networks via
    a modified POP3 port number.
    - http://squirrelmail.org/security/issue/2010-06-21
    - CVE-2010-1637
    - Patch taken from upstream svn rev. 13951. Applied inline.

 -- Andreas Wenning   Thu, 24 Jun 2010 14:17:43 +0200
Source diff to previous version
598077 squirrelmail: "CVE-2010-1637 Mail fetch plugin can be used as proxy for port scan"
CVE-2010-1637 The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a p

Version: 2:1.4.19-1ubuntu0.1 2010-02-09 00:02:05 UTC 
squirrelmail (2:1.4.19-1ubuntu0.1) karmic-security; urgency=low

  * SECURITY UPDATE: (LP: #446838)
  * Multiple cross-site request forgery (CSRF) in all
    forms submissions
  * edited:
    src/addrbook_search_html.php,src/addressbook.php,src/compose.php
    src/folders_create.php,src/folders_delete.php,src/folders.php,
    src/folders_rename_do.php,src/folders_rename_getname.php,
    src/folders_subscribe.php,functions/forms.php,
    functions/mailbox_display.php,src/move_messages.php,
    src/options_highlight.php,src/options_identities.php,
    src/options_order.php,src/options.php,src/search.php,
    functions/strings.php,src/vcard.php
  * Fixes : CVE-2009-2964
    - http://www.squirrelmail.org/security/issue/2009-08-12
    - patches taken from upstream rev 13818
    - patches applied inline

 -- Leonel Nunez   Sun, 11 Oct 2009 19:18:52 -0600
446838 squirrelmail: "Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier"
CVE-2009-2964 Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijac


About   -   Changelog   -   Send Feedback