1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 1682-1] New squirrelmail packages fix cross site script

    From Thijs Kinkhorst@1:229/2 to All on Sun Dec 7 17:30:11 2008
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------ Debian Security Advisory DSA-168201 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 07, 2008 http://www.debian.org/security/faq
    - ------------------------------------------------------------------------

    Package : squirrelmail
    Vulnerability : insufficient input sanitising
    Problem type : remote
    Debian-specific: no
    CVE Id(s) : CVE-2008-2379

    Ivan Markovic discovered that SquirrelMail, a webmail application, did not sufficiently sanitise incoming HTML email, allowing an attacker to perform cross site scripting through sending a malicious HTML email.

    For the stable distribution (etch), this problem has been fixed in
    version 1.4.9a-3.

    For the unstable distribution (sid), this problem has been fixed in
    version 1.4.15-4.

    We recommend that you upgrade your squirrelmail package.

    Upgrade instructions
    - --------------------

    wget url
    will fetch the file for you
    dpkg -i file.deb
    will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
    will update the internal database
    apt-get upgrade
    will install corrected packages

    You may use an automated update by adding the resources from the
    footer to the proper configuration.


    Debian GNU/Linux 4.0 alias etch
    - -------------------------------

    Source archives:

    http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a-3.diff.gz
    Size/MD5 checksum: 23420 b1755b11f721f2bdc7c5a100cf83f1d6
    http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a.orig.tar.gz
    Size/MD5 checksum: 598950 5b19f8cc5badef91d1f2410df41564bc
    http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a-3.dsc
    Size/MD5 checksum: 1021 9954f8522b7059cb115f5a77405c298f

    Architecture independent packages:

    http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a-3_all.deb
    Size/MD5 checksum: 591892 35c2060553f375b9bd8759d06b401153


    These files will probably be moved into the stable distribution on
    its next update.

    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: [email protected]
    Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)

    iQEVAwUBSTv2wGz0hbPcukPfAQIIwgf+OFYz0lUhZHOXrbTGhw3Nd+eQujaYB+oR fgtKT9WpHNP/lYdBtuSj6LouGH5sLMlCSaUGwzMGfuCOKqB1ghFKOaeB5Yu1Oe0i 0ZZiofVeUmGbU+lee8l4Z11Okwg1Ck4/4raHrA06hpJnSno43o/JjVybXJr2pdGq keYvtp5c2rhqr0kLqdpG9ZUPRnv69kstkHrWErPS8+/qRKewoSKN8N7KVeAd1Dva Rx0ZHGc1ASJTPwMOaH/UiDFLxmS8weYnKkmWDk0mATN1qkXr6DZmHsQ2qMK7J+Eh cWkSKTVNUtY2pk3Ka4I1ZmyyRoc1cZBmi6vs8Lo9EXK50m3VCgKojw==
    =PwzV
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)