| Description: | Description:
The remote host is missing an update to squirrelmail
announced via advisory FEDORA-2008-10740.
SquirrelMail is a basic webmail package written in PHP4. It
includes built-in pure PHP support for the IMAP and SMTP protocols, and
all pages render in pure HTML 4.0 (with no Javascript) for maximum
compatibility across browsers. It has very few requirements and is very
easy to configure and install.
Update Information:
update to 1.4.17 fixes XSS issue caused by an insufficient html mail sanitation
ChangeLog:
* Thu Dec 4 2008 Michal Hlavinka - 1.4.17-1
- update to 1.4.17 (fixes CVE-2008-2379)
* Wed Oct 1 2008 Michal Hlavinka - 1.4.16-1
- update to 1.4.16
- resolves: #464185: CVE-2008-3663 Squirrelmail session hijacking
References:
[ 1 ] Bug #473877 - CVE-2008-2379 squirrelmail: XSS issue caused by an insufficient html mail sanitation
https://bugzilla.redhat.com/show_bug.cgi?id=473877
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update squirrelmail' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2008-10740
Risk factor : Medium
CVSS Score:
5.0
|
