DATABASE RESOURCES PRICING ABOUT US

{"id": "RHSA-2012:0103", "vendorId": null, "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2012:0103) Moderate: squirrelmail security update", "description": "SquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail\nperformed the sanitization of HTML style tag content. A remote attacker\ncould use this flaw to send a specially-crafted Multipurpose Internet Mail\nExtensions (MIME) message that, when opened by a victim, would lead to\narbitrary web script execution in the context of their SquirrelMail\nsession. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\nremote attacker could possibly use these flaws to execute arbitrary web\nscript in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled the\ncontent of various HTML input fields. A remote attacker could use this\nflaw to alter user preference values via a newline character contained in\nthe input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages did\nnot protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\nattacker could trick a user, who was logged into SquirrelMail, into\nvisiting a specially-crafted URL, the attacker could empty the victim's\ntrash folder or alter the ordering of the columns on the message index\npage. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\nremote attacker to perform a clickjacking attack against logged in users\nand possibly gain access to sensitive user data. With this update, the\nSquirrelMail main frame can only be loaded into the top most browser frame.\n(CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in attempts. A\nuser preference file was created when attempting to log in with a password\ncontaining an 8-bit character, even if the username was not valid. A\nremote attacker could use this flaw to eventually consume all hard disk\nspace on the target SquirrelMail server. (CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an\nadministrator enabled this plug-in, a SquirrelMail user could use this flaw\nto port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which\ncontains backported patches to correct these issues.\n", "published": "2012-02-08T00:00:00", "modified": "2017-09-08T08:17:14", "epss": [{"cve": "CVE-2010-1637", "epss": 0.00261, "percentile": 0.6361, "modified": "2023-11-11"}, {"cve": "CVE-2010-2813", "epss": 0.11469, "percentile": 0.94672, "modified": "2023-11-11"}, {"cve": "CVE-2010-4554", "epss": 0.00446, "percentile": 0.72064, "modified": "2023-11-11"}, {"cve": "CVE-2010-4555", "epss": 0.00316, "percentile": 0.67039, "modified": "2023-11-11"}, {"cve": "CVE-2011-2023", "epss": 0.00317, "percentile": 0.6709, "modified": "2023-11-11"}, {"cve": "CVE-2011-2752", "epss": 0.0099, "percentile": 0.81796, "modified": "2023-11-11"}, {"cve": "CVE-2011-2753", "epss": 0.00304, "percentile": 0.66309, "modified": "2023-11-11"}], "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {}, "href": "https://access.redhat.com/errata/RHSA-2012:0103", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "immutableFields": [], "lastseen": "2021-10-21T04:46:58", "viewCount": 14, "enchantments": {"score": {"value": 0.6, "vector": "NONE"}, "dependencies": {"references": [{"type": "centos", "idList": ["CESA-2012:0103", "CESA-2013:0126"]}, {"type": "cve", "idList": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753", "CVE-2012-2124"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2091-1:23614", "DEBIAN:DSA-2291-1:B447A"]}, {"type": "fedora", "idList": ["FEDORA:0A9BE110E2F", "FEDORA:1D01A11130D", "FEDORA:1EB69111183", "FEDORA:5FF621106AE", "FEDORA:96703110DB8", "FEDORA:D55C11113FA", "FEDORA:F30E111118B"]}, {"type": "nessus", "idList": ["CENTOS_RHSA-2012-0103.NASL", "CENTOS_RHSA-2013-0126.NASL", "DEBIAN_DSA-2091.NASL", "DEBIAN_DSA-2291.NASL", "FEDORA_2010-10244.NASL", "FEDORA_2010-10259.NASL", "FEDORA_2010-10264.NASL", "FEDORA_2010-11410.NASL", "FEDORA_2010-11422.NASL", "FEDORA_2011-9309.NASL", "FEDORA_2011-9311.NASL", "MACOSX_SECUPD2012-001.NASL", "ORACLELINUX_ELSA-2012-0103.NASL", "ORACLELINUX_ELSA-2013-0126.NASL", "REDHAT-RHSA-2012-0103.NASL", "REDHAT-RHSA-2013-0126.NASL", "SL_20120208_SQUIRRELMAIL_ON_SL4_X.NASL", "SL_20130108_SQUIRRELMAIL_ON_SL5_X.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310100688", "OPENVAS:1361412562310100759", "OPENVAS:1361412562310123994", "OPENVAS:136141256231067845", "OPENVAS:136141256231070227", "OPENVAS:1361412562310802392", "OPENVAS:1361412562310830985", "OPENVAS:1361412562310831095", "OPENVAS:1361412562310831136", "OPENVAS:1361412562310831438", "OPENVAS:1361412562310862178", "OPENVAS:1361412562310862181", "OPENVAS:1361412562310862196", "OPENVAS:1361412562310862307", "OPENVAS:1361412562310862309", "OPENVAS:1361412562310863382", "OPENVAS:1361412562310863384", "OPENVAS:1361412562310870543", "OPENVAS:1361412562310870880", "OPENVAS:1361412562310881223", "OPENVAS:1361412562310881232", "OPENVAS:1361412562310881572", "OPENVAS:67845", "OPENVAS:70227", "OPENVAS:802392", "OPENVAS:830985", "OPENVAS:831095", "OPENVAS:831136", "OPENVAS:831438", "OPENVAS:862178", "OPENVAS:862181", "OPENVAS:862196", "OPENVAS:862307", "OPENVAS:862309", "OPENVAS:863382", "OPENVAS:863384", "OPENVAS:870543", "OPENVAS:870880", "OPENVAS:881223", "OPENVAS:881232", "OPENVAS:881572"]}, {"type": "oraclelinux", "idList": ["ELSA-2012-0103", "ELSA-2013-0126"]}, {"type": "osv", "idList": ["OSV:DSA-2091-1", "OSV:DSA-2291-1"]}, {"type": "redhat", "idList": ["RHSA-2013:0126"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:24526", "SECURITYVULNS:DOC:27600", "SECURITYVULNS:VULN:11070", "SECURITYVULNS:VULN:11853", "SECURITYVULNS:VULN:12164"]}, {"type": "seebug", "idList": ["SSV:20730"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2010-1637", "UB:CVE-2010-2813", "UB:CVE-2010-4554", "UB:CVE-2010-4555", "UB:CVE-2011-2023", "UB:CVE-2011-2752", "UB:CVE-2011-2753", "UB:CVE-2012-2124"]}, {"type": "veracode", "idList": ["VERACODE:10835", "VERACODE:24824", "VERACODE:24825", "VERACODE:24826", "VERACODE:24827", "VERACODE:24828", "VERACODE:24829", "VERACODE:24830"]}]}, "backreferences": {"references": [{"type": "centos", "idList": ["CESA-2012:0103", "CESA-2013:0126"]}, {"type": "cve", "idList": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555"]}, {"type": "fedora", "idList": ["FEDORA:0A9BE110E2F"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/CENTOS_LINUX-CVE-2010-1637/"]}, {"type": "nessus", "idList": ["6303.PRM", "FEDORA_2010-11410.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:881572"]}, {"type": "oraclelinux", "idList": ["ELSA-2012-0103", "ELSA-2013-0126"]}, {"type": "redhat", "idList": ["RHSA-2013:0126"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:27600"]}, {"type": "seebug", "idList": ["SSV:20730"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2010-4554"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2010-1637", "epss": "0.002610000", "percentile": "0.620570000", "modified": "2023-03-15"}, {"cve": "CVE-2010-2813", "epss": "0.114690000", "percentile": "0.943080000", "modified": "2023-03-15"}, {"cve": "CVE-2010-4554", "epss": "0.004460000", "percentile": "0.710040000", "modified": "2023-03-15"}, {"cve": "CVE-2010-4555", "epss": "0.003160000", "percentile": "0.656390000", "modified": "2023-03-15"}, {"cve": "CVE-2011-2023", "epss": "0.003170000", "percentile": "0.656830000", "modified": "2023-03-15"}, {"cve": "CVE-2011-2752", "epss": "0.009900000", "percentile": "0.812210000", "modified": "2023-03-15"}, {"cve": "CVE-2011-2753", "epss": "0.003040000", "percentile": "0.649640000", "modified": "2023-03-15"}], "vulnersScore": 0.6}, "_state": {"dependencies": 1699783982, "score": 1699784675, "epss": 0}, "_internal": {"score_hash": "5c77e39747e505ff696405989d813278"}, "affectedPackage": [{"OS": "RedHat", "OSVersion": "4", "arch": "noarch", "packageVersion": "1.4.8-18.el4", "packageFilename": "squirrelmail-1.4.8-18.el4.noarch.rpm", "operator": "lt", "packageName": "squirrelmail"}, {"OS": "RedHat", "OSVersion": "5", "arch": "src", "packageVersion": "1.4.8-5.el5_7.13", "packageFilename": "squirrelmail-1.4.8-5.el5_7.13.src.rpm", "operator": "lt", "packageName": "squirrelmail"}, {"OS": "RedHat", "OSVersion": "4", "arch": "src", "packageVersion": "1.4.8-18.el4", "packageFilename": "squirrelmail-1.4.8-18.el4.src.rpm", "operator": "lt", "packageName": "squirrelmail"}, {"OS": "RedHat", "OSVersion": "5", "arch": "noarch", "packageVersion": "1.4.8-5.el5_7.13", "packageFilename": "squirrelmail-1.4.8-5.el5_7.13.noarch.rpm", "operator": "lt", "packageName": "squirrelmail"}], "vendorCvss": {"severity": "moderate"}}

{"openvas": [{"lastseen": "2019-05-29T18:38:36", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2012-07-30T00:00:00", "type": "openvas", "title": "CentOS Update for squirrelmail CESA-2012:0103 centos4", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310881223", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881223", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for squirrelmail CESA-2012:0103 centos4\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2012-February/018422.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.881223\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-30 16:50:51 +0530 (Mon, 30 Jul 2012)\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\",\n \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name:\"CESA\", value:\"2012:0103\");\n script_name(\"CentOS Update for squirrelmail CESA-2012:0103 centos4\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS4\");\n script_tag(name:\"affected\", value:\"squirrelmail on CentOS 4\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"insight\", value:\"SquirrelMail is a standards-based webmail package written in PHP.\n\n A cross-site scripting (XSS) flaw was found in the way SquirrelMail\n performed the sanitization of HTML style tag content. A remote attacker\n could use this flaw to send a specially-crafted Multipurpose Internet Mail\n Extensions (MIME) message that, when opened by a victim, would lead to\n arbitrary web script execution in the context of their SquirrelMail\n session. (CVE-2011-2023)\n\n Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\n remote attacker could possibly use these flaws to execute arbitrary web\n script in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n\n An input sanitization flaw was found in the way SquirrelMail handled the\n content of various HTML input fields. A remote attacker could use this\n flaw to alter user preference values via a newline character contained in\n the input for these fields. (CVE-2011-2752)\n\n It was found that the SquirrelMail Empty Trash and Index Order pages did\n not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\n attacker could trick a user, who was logged into SquirrelMail, into\n visiting a specially-crafted URL, the attacker could empty the victim's\n trash folder or alter the ordering of the columns on the message index\n page. (CVE-2011-2753)\n\n SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\n remote attacker to perform a clickjacking attack against logged in users\n and possibly gain access to sensitive user data. With this update, the\n SquirrelMail main frame can only be loaded into the top most browser frame.\n (CVE-2010-4554)\n\n A flaw was found in the way SquirrelMail handled failed log in attempts. A\n user preference file was created when attempting to log in with a password\n containing an 8-bit character, even if the username was not valid. A\n remote attacker could use this flaw to eventually consume all hard disk\n space on the target SquirrelMail server. (CVE-2010-2813)\n\n A flaw was found in the SquirrelMail Mail Fetch plug-in. If an\n administrator enabled this plug-in, a SquirrelMail user could use this flaw\n to port scan the local network the server was on. (CVE-2010-1637)\n\n Users of SquirrelMail should upgrade to this updated package, which\n contains backported patches to correct these issues.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS4\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~18.el4.centos\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:38:37", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2012-07-30T00:00:00", "type": "openvas", "title": "CentOS Update for squirrelmail CESA-2012:0103 centos5", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310881232", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881232", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for squirrelmail CESA-2012:0103 centos5\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2012-February/018423.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.881232\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-30 16:53:37 +0530 (Mon, 30 Jul 2012)\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\",\n \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name:\"CESA\", value:\"2012:0103\");\n script_name(\"CentOS Update for squirrelmail CESA-2012:0103 centos5\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS5\");\n script_tag(name:\"affected\", value:\"squirrelmail on CentOS 5\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"insight\", value:\"SquirrelMail is a standards-based webmail package written in PHP.\n\n A cross-site scripting (XSS) flaw was found in the way SquirrelMail\n performed the sanitization of HTML style tag content. A remote attacker\n could use this flaw to send a specially-crafted Multipurpose Internet Mail\n Extensions (MIME) message that, when opened by a victim, would lead to\n arbitrary web script execution in the context of their SquirrelMail\n session. (CVE-2011-2023)\n\n Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\n remote attacker could possibly use these flaws to execute arbitrary web\n script in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n\n An input sanitization flaw was found in the way SquirrelMail handled the\n content of various HTML input fields. A remote attacker could use this\n flaw to alter user preference values via a newline character contained in\n the input for these fields. (CVE-2011-2752)\n\n It was found that the SquirrelMail Empty Trash and Index Order pages did\n not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\n attacker could trick a user, who was logged into SquirrelMail, into\n visiting a specially-crafted URL, the attacker could empty the victim's\n trash folder or alter the ordering of the columns on the message index\n page. (CVE-2011-2753)\n\n SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\n remote attacker to perform a clickjacking attack against logged in users\n and possibly gain access to sensitive user data. With this update, the\n SquirrelMail main frame can only be loaded into the top most browser frame.\n (CVE-2010-4554)\n\n A flaw was found in the way SquirrelMail handled failed log in attempts. A\n user preference file was created when attempting to log in with a password\n containing an 8-bit character, even if the username was not valid. A\n remote attacker could use this flaw to eventually consume all hard disk\n space on the target SquirrelMail server. (CVE-2010-2813)\n\n A flaw was found in the SquirrelMail Mail Fetch plug-in. If an\n administrator enabled this plug-in, a SquirrelMail user could use this flaw\n to port scan the local network the server was on. (CVE-2010-1637)\n\n Users of SquirrelMail should upgrade to this updated package, which\n contains backported patches to correct these issues.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~5.el5.centos.13\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2018-01-11T11:06:47", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2012-07-30T00:00:00", "type": "openvas", "title": "CentOS Update for squirrelmail CESA-2012:0103 centos5 ", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2018-01-09T00:00:00", "id": "OPENVAS:881232", "href": "http://plugins.openvas.org/nasl.php?oid=881232", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for squirrelmail CESA-2012:0103 centos5 \n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail is a standards-based webmail package written in PHP.\n\n A cross-site scripting (XSS) flaw was found in the way SquirrelMail\n performed the sanitization of HTML style tag content. A remote attacker\n could use this flaw to send a specially-crafted Multipurpose Internet Mail\n Extensions (MIME) message that, when opened by a victim, would lead to\n arbitrary web script execution in the context of their SquirrelMail\n session. (CVE-2011-2023)\n \n Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\n remote attacker could possibly use these flaws to execute arbitrary web\n script in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n \n An input sanitization flaw was found in the way SquirrelMail handled the\n content of various HTML input fields. A remote attacker could use this\n flaw to alter user preference values via a newline character contained in\n the input for these fields. (CVE-2011-2752)\n \n It was found that the SquirrelMail Empty Trash and Index Order pages did\n not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\n attacker could trick a user, who was logged into SquirrelMail, into\n visiting a specially-crafted URL, the attacker could empty the victim's\n trash folder or alter the ordering of the columns on the message index\n page. (CVE-2011-2753)\n \n SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\n remote attacker to perform a clickjacking attack against logged in users\n and possibly gain access to sensitive user data. With this update, the\n SquirrelMail main frame can only be loaded into the top most browser frame.\n (CVE-2010-4554)\n \n A flaw was found in the way SquirrelMail handled failed log in attempts. A\n user preference file was created when attempting to log in with a password\n containing an 8-bit character, even if the username was not valid. A\n remote attacker could use this flaw to eventually consume all hard disk\n space on the target SquirrelMail server. (CVE-2010-2813)\n \n A flaw was found in the SquirrelMail Mail Fetch plug-in. If an\n administrator enabled this plug-in, a SquirrelMail user could use this flaw\n to port scan the local network the server was on. (CVE-2010-1637)\n \n Users of SquirrelMail should upgrade to this updated package, which\n contains backported patches to correct these issues.\";\n\ntag_affected = \"squirrelmail on CentOS 5\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2012-February/018423.html\");\n script_id(881232);\n script_version(\"$Revision: 8336 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-09 08:01:48 +0100 (Tue, 09 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-30 16:53:37 +0530 (Mon, 30 Jul 2012)\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\",\n \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name: \"CESA\", value: \"2012:0103\");\n script_name(\"CentOS Update for squirrelmail CESA-2012:0103 centos5 \");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~5.el5.centos.13\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-01-11T11:07:59", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2012-07-30T00:00:00", "type": "openvas", "title": "CentOS Update for squirrelmail CESA-2012:0103 centos4 ", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2018-01-09T00:00:00", "id": "OPENVAS:881223", "href": "http://plugins.openvas.org/nasl.php?oid=881223", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for squirrelmail CESA-2012:0103 centos4 \n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail is a standards-based webmail package written in PHP.\n\n A cross-site scripting (XSS) flaw was found in the way SquirrelMail\n performed the sanitization of HTML style tag content. A remote attacker\n could use this flaw to send a specially-crafted Multipurpose Internet Mail\n Extensions (MIME) message that, when opened by a victim, would lead to\n arbitrary web script execution in the context of their SquirrelMail\n session. (CVE-2011-2023)\n \n Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\n remote attacker could possibly use these flaws to execute arbitrary web\n script in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n \n An input sanitization flaw was found in the way SquirrelMail handled the\n content of various HTML input fields. A remote attacker could use this\n flaw to alter user preference values via a newline character contained in\n the input for these fields. (CVE-2011-2752)\n \n It was found that the SquirrelMail Empty Trash and Index Order pages did\n not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\n attacker could trick a user, who was logged into SquirrelMail, into\n visiting a specially-crafted URL, the attacker could empty the victim's\n trash folder or alter the ordering of the columns on the message index\n page. (CVE-2011-2753)\n \n SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\n remote attacker to perform a clickjacking attack against logged in users\n and possibly gain access to sensitive user data. With this update, the\n SquirrelMail main frame can only be loaded into the top most browser frame.\n (CVE-2010-4554)\n \n A flaw was found in the way SquirrelMail handled failed log in attempts. A\n user preference file was created when attempting to log in with a password\n containing an 8-bit character, even if the username was not valid. A\n remote attacker could use this flaw to eventually consume all hard disk\n space on the target SquirrelMail server. (CVE-2010-2813)\n \n A flaw was found in the SquirrelMail Mail Fetch plug-in. If an\n administrator enabled this plug-in, a SquirrelMail user could use this flaw\n to port scan the local network the server was on. (CVE-2010-1637)\n \n Users of SquirrelMail should upgrade to this updated package, which\n contains backported patches to correct these issues.\";\n\ntag_affected = \"squirrelmail on CentOS 4\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2012-February/018422.html\");\n script_id(881223);\n script_version(\"$Revision: 8336 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-09 08:01:48 +0100 (Tue, 09 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-30 16:50:51 +0530 (Mon, 30 Jul 2012)\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\",\n \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name: \"CESA\", value: \"2012:0103\");\n script_name(\"CentOS Update for squirrelmail CESA-2012:0103 centos4 \");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS4\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~18.el4.centos\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:36:07", "description": "Oracle Linux Local Security Checks ELSA-2012-0103", "cvss3": {}, "published": "2015-10-06T00:00:00", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2012-0103", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2018-09-28T00:00:00", "id": "OPENVAS:1361412562310123994", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123994", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2012-0103.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.123994\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:11:21 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2012-0103\");\n script_tag(name:\"insight\", value:\"ELSA-2012-0103 - squirrelmail security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2012-0103\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2012-0103.html\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~5.0.1.el5_7.13\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2018-01-03T10:58:41", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2012-02-13T00:00:00", "type": "openvas", "title": "RedHat Update for squirrelmail RHSA-2012:0103-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2018-01-03T00:00:00", "id": "OPENVAS:870543", "href": "http://plugins.openvas.org/nasl.php?oid=870543", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for squirrelmail RHSA-2012:0103-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail is a standards-based webmail package written in PHP.\n\n A cross-site scripting (XSS) flaw was found in the way SquirrelMail\n performed the sanitization of HTML style tag content. A remote attacker\n could use this flaw to send a specially-crafted Multipurpose Internet Mail\n Extensions (MIME) message that, when opened by a victim, would lead to\n arbitrary web script execution in the context of their SquirrelMail\n session. (CVE-2011-2023)\n \n Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\n remote attacker could possibly use these flaws to execute arbitrary web\n script in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n \n An input sanitization flaw was found in the way SquirrelMail handled the\n content of various HTML input fields. A remote attacker could use this\n flaw to alter user preference values via a newline character contained in\n the input for these fields. (CVE-2011-2752)\n \n It was found that the SquirrelMail Empty Trash and Index Order pages did\n not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\n attacker could trick a user, who was logged into SquirrelMail, into\n visiting a specially-crafted URL, the attacker could empty the victim's\n trash folder or alter the ordering of the columns on the message index\n page. (CVE-2011-2753)\n \n SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\n remote attacker to perform a clickjacking attack against logged in users\n and possibly gain access to sensitive user data. With this update, the\n SquirrelMail main frame can only be loaded into the top most browser frame.\n (CVE-2010-4554)\n \n A flaw was found in the way SquirrelMail handled failed log in attempts. A\n user preference file was created when attempting to log in with a password\n containing an 8-bit character, even if the username was not valid. A\n remote attacker could use this flaw to eventually consume all hard disk\n space on the target SquirrelMail server. (CVE-2010-2813)\n \n A flaw was found in the SquirrelMail Mail Fetch plug-in. If an\n administrator enabled this plug-in, a SquirrelMail user could use this flaw\n to port scan the local network the server was on. (CVE-2010-1637)\n \n Users of SquirrelMail should upgrade to this updated package, which\n contains backported patches to correct these issues.\";\n\ntag_affected = \"squirrelmail on Red Hat Enterprise Linux (v. 5 server),\n Red Hat Enterprise Linux AS version 4,\n Red Hat Enterprise Linux ES version 4,\n Red Hat Enterprise Linux WS version 4\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/rhsa-announce/2012-February/msg00021.html\");\n script_id(870543);\n script_version(\"$Revision: 8273 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-03 07:29:19 +0100 (Wed, 03 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-13 16:28:49 +0530 (Mon, 13 Feb 2012)\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\",\n \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name: \"RHSA\", value: \"2012:0103-01\");\n script_name(\"RedHat Update for squirrelmail RHSA-2012:0103-01\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~5.el5_7.13\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"RHENT_4\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~18.el4\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:38:54", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2012-02-13T00:00:00", "type": "openvas", "title": "RedHat Update for squirrelmail RHSA-2012:0103-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2018-11-23T00:00:00", "id": "OPENVAS:1361412562310870543", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870543", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for squirrelmail RHSA-2012:0103-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2012-February/msg00021.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.870543\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-13 16:28:49 +0530 (Mon, 13 Feb 2012)\");\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\",\n \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name:\"RHSA\", value:\"2012:0103-01\");\n script_name(\"RedHat Update for squirrelmail RHSA-2012:0103-01\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_(5|4)\");\n script_tag(name:\"affected\", value:\"squirrelmail on Red Hat Enterprise Linux (v. 5 server),\n Red Hat Enterprise Linux AS version 4,\n Red Hat Enterprise Linux ES version 4,\n Red Hat Enterprise Linux WS version 4\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"SquirrelMail is a standards-based webmail package written in PHP.\n\n A cross-site scripting (XSS) flaw was found in the way SquirrelMail\n performed the sanitization of HTML style tag content. A remote attacker\n could use this flaw to send a specially-crafted Multipurpose Internet Mail\n Extensions (MIME) message that, when opened by a victim, would lead to\n arbitrary web script execution in the context of their SquirrelMail\n session. (CVE-2011-2023)\n\n Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\n remote attacker could possibly use these flaws to execute arbitrary web\n script in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n\n An input sanitization flaw was found in the way SquirrelMail handled the\n content of various HTML input fields. A remote attacker could use this\n flaw to alter user preference values via a newline character contained in\n the input for these fields. (CVE-2011-2752)\n\n It was found that the SquirrelMail Empty Trash and Index Order pages did\n not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\n attacker could trick a user, who was logged into SquirrelMail, into\n visiting a specially-crafted URL, the attacker could empty the victim's\n trash folder or alter the ordering of the columns on the message index\n page. (CVE-2011-2753)\n\n SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\n remote attacker to perform a clickjacking attack against logged in users\n and possibly gain access to sensitive user data. With this update, the\n SquirrelMail main frame can only be loaded into the top most browser frame.\n (CVE-2010-4554)\n\n A flaw was found in the way SquirrelMail handled failed log in attempts. A\n user preference file was created when attempting to log in with a password\n containing an 8-bit character, even if the username was not valid. A\n remote attacker could use this flaw to eventually consume all hard disk\n space on the target SquirrelMail server. (CVE-2010-2813)\n\n A flaw was found in the SquirrelMail Mail Fetch plug-in. If an\n administrator enabled this plug-in, a SquirrelMail user could use this flaw\n to port scan the local network the server was on. (CVE-2010-1637)\n\n Users of SquirrelMail should upgrade to this updated package, which\n contains backported patches to correct these issues.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~5.el5_7.13\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"RHENT_4\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~18.el4\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-07-24T12:55:52", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2011-08-18T00:00:00", "type": "openvas", "title": "Mandriva Update for squirrelmail MDVSA-2011:123 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:831438", "href": "http://plugins.openvas.org/nasl.php?oid=831438", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for squirrelmail MDVSA-2011:123 (squirrelmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities has been discovered and corrected in\n squirrelmail:\n\n functions/page_header.php in SquirrelMail 1.4.21 and earlier does not\n prevent page rendering inside a frame in a third-party HTML document,\n which makes it easier for remote attackers to conduct clickjacking\n attacks via a crafted web site (CVE-2010-4554).\n \n Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail\n 1.4.21 and earlier allow remote attackers to inject arbitrary\n web script or HTML via vectors involving (1) drop-down selection\n lists, (2) the &amp;gt; (greater than) character in the SquirrelSpell\n spellchecking plugin, and (3) errors associated with the Index Order\n (aka options_order) page (CVE-2010-4555).\n \n Cross-site scripting (XSS) vulnerability in functions/mime.php in\n SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary\n web script or HTML via a crafted STYLE element in an e-mail message\n (CVE-2011-2023).\n \n CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier\n allows remote attackers to modify or add preference values via a \\n\n (newline) character, a different vulnerability than CVE-2010-4555\n (CVE-2011-2752).\n \n Multiple cross-site request forgery (CSRF) vulnerabilities in\n SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the\n authentication of unspecified victims via vectors involving (1) the\n empty trash implementation and (2) the Index Order (aka options_order)\n page, a different issue than CVE-2010-4555 (CVE-2011-2753).\n \n The updated packages have been upgraded to the 1.4.22 version which\n is not vulnerable to these issues.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"squirrelmail on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2011-08/msg00005.php\");\n script_id(831438);\n script_version(\"$Revision: 6565 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 14:56:06 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-18 14:57:45 +0200 (Thu, 18 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name: \"MDVSA\", value: \"2011:123\");\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_name(\"Mandriva Update for squirrelmail MDVSA-2011:123 (squirrelmail)\");\n\n script_summary(\"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ar\", rpm:\"squirrelmail-ar~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bg\", rpm:\"squirrelmail-bg~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-bangladesh\", rpm:\"squirrelmail-bn-bangladesh~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-india\", rpm:\"squirrelmail-bn-india~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ca\", rpm:\"squirrelmail-ca~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cs\", rpm:\"squirrelmail-cs~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cy\", rpm:\"squirrelmail-cy~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cyrus\", rpm:\"squirrelmail-cyrus~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-da\", rpm:\"squirrelmail-da~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-de\", rpm:\"squirrelmail-de~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-el\", rpm:\"squirrelmail-el~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-es\", rpm:\"squirrelmail-es~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-et\", rpm:\"squirrelmail-et~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-eu\", rpm:\"squirrelmail-eu~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fa\", rpm:\"squirrelmail-fa~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fi\", rpm:\"squirrelmail-fi~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fo\", rpm:\"squirrelmail-fo~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fr\", rpm:\"squirrelmail-fr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fy\", rpm:\"squirrelmail-fy~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-he\", rpm:\"squirrelmail-he~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hr\", rpm:\"squirrelmail-hr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hu\", rpm:\"squirrelmail-hu~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-id\", rpm:\"squirrelmail-id~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-is\", rpm:\"squirrelmail-is~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-it\", rpm:\"squirrelmail-it~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ja\", rpm:\"squirrelmail-ja~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ka\", rpm:\"squirrelmail-ka~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-km\", rpm:\"squirrelmail-km~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ko\", rpm:\"squirrelmail-ko~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lt\", rpm:\"squirrelmail-lt~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lv\", rpm:\"squirrelmail-lv~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-mk\", rpm:\"squirrelmail-mk~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ms\", rpm:\"squirrelmail-ms~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nb\", rpm:\"squirrelmail-nb~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nl\", rpm:\"squirrelmail-nl~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nn\", rpm:\"squirrelmail-nn~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pl\", rpm:\"squirrelmail-pl~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-poutils\", rpm:\"squirrelmail-poutils~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pt\", rpm:\"squirrelmail-pt~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ro\", rpm:\"squirrelmail-ro~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ru\", rpm:\"squirrelmail-ru~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sk\", rpm:\"squirrelmail-sk~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sl\", rpm:\"squirrelmail-sl~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sr\", rpm:\"squirrelmail-sr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sv\", rpm:\"squirrelmail-sv~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ta\", rpm:\"squirrelmail-ta~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-th\", rpm:\"squirrelmail-th~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-tr\", rpm:\"squirrelmail-tr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ug\", rpm:\"squirrelmail-ug~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-uk\", rpm:\"squirrelmail-uk~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-vi\", rpm:\"squirrelmail-vi~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_CN\", rpm:\"squirrelmail-zh_CN~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_TW\", rpm:\"squirrelmail-zh_TW~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:55:51", "description": "The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2291-1.", "cvss3": {}, "published": "2011-09-21T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2291-1 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:70227", "href": "http://plugins.openvas.org/nasl.php?oid=70227", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2291_1.nasl 6613 2017-07-07 12:08:40Z cfischer $\n# Description: Auto-generated from advisory DSA 2291-1 (squirrelmail)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Various vulnerabilities have been found in SquirrelMail, a webmail\napplication. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:\n\nCVE-2010-4554\n\nSquirrelMail did not prevent page rendering inside a third-party\nHTML frame, which makes it easier for remote attackers to conduct\nclickjacking attacks via a crafted web site.\n\nCVE-2010-4555, CVE-2011-2752, CVE-2011-2753\n\nMultiple small bugs in SquirrelMail allowed an attacker to inject\nmalicious script into various pages or alter the contents of user\npreferences.\n\nCVE-2011-2023\n\nIt was possible to inject arbitrary web script or HTML via a\ncrafted STYLE element in an HTML part of an e-mail message.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 1.4.15-4+lenny5.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1.4.21-2.\n\nFor the testing (wheezy) and unstable distribution (sid), these problems\nhave been fixed in version 1.4.22-1.\n\nWe recommend that you upgrade your squirrelmail packages.\";\ntag_summary = \"The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2291-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202291-1\";\n\n\nif(description)\n{\n script_id(70227);\n script_version(\"$Revision: 6613 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:40 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-09-21 05:47:11 +0200 (Wed, 21 Sep 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_name(\"Debian Security Advisory DSA 2291-1 (squirrelmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"squirrelmail\", ver:\"2:1.4.15-4+lenny5\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"squirrelmail\", ver:\"2:1.4.21-2\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:39:46", "description": "The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2291-1.", "cvss3": {}, "published": "2011-09-21T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2291-1 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:136141256231070227", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070227", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2291_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2291-1 (squirrelmail)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70227\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-09-21 05:47:11 +0200 (Wed, 21 Sep 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_name(\"Debian Security Advisory DSA 2291-1 (squirrelmail)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(5|6)\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202291-1\");\n script_tag(name:\"insight\", value:\"Various vulnerabilities have been found in SquirrelMail, a webmail\napplication. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:\n\nCVE-2010-4554\n\nSquirrelMail did not prevent page rendering inside a third-party\nHTML frame, which makes it easier for remote attackers to conduct\nclickjacking attacks via a crafted web site.\n\nCVE-2010-4555, CVE-2011-2752, CVE-2011-2753\n\nMultiple small bugs in SquirrelMail allowed an attacker to inject\nmalicious script into various pages or alter the contents of user\npreferences.\n\nCVE-2011-2023\n\nIt was possible to inject arbitrary web script or HTML via a\ncrafted STYLE element in an HTML part of an e-mail message.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 1.4.15-4+lenny5.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1.4.21-2.\n\nFor the testing (wheezy) and unstable distribution (sid), these problems\nhave been fixed in version 1.4.22-1.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your squirrelmail packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2291-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"squirrelmail\", ver:\"2:1.4.15-4+lenny5\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"squirrelmail\", ver:\"2:1.4.21-2\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:39:52", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-08-18T00:00:00", "type": "openvas", "title": "Mandriva Update for squirrelmail MDVSA-2011:123 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2019-03-12T00:00:00", "id": "OPENVAS:1361412562310831438", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831438", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for squirrelmail MDVSA-2011:123 (squirrelmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.mandriva.com/security-announce/2011-08/msg00005.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831438\");\n script_version(\"$Revision: 14114 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-12 12:48:52 +0100 (Tue, 12 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-18 14:57:45 +0200 (Thu, 18 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_xref(name:\"MDVSA\", value:\"2011:123\");\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_name(\"Mandriva Update for squirrelmail MDVSA-2011:123 (squirrelmail)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\", re:\"ssh/login/release=MNDK_mes5\");\n script_tag(name:\"affected\", value:\"squirrelmail on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities has been discovered and corrected in\n squirrelmail:\n\n functions/page_header.php in SquirrelMail 1.4.21 and earlier does not\n prevent page rendering inside a frame in a third-party HTML document,\n which makes it easier for remote attackers to conduct clickjacking\n attacks via a crafted web site (CVE-2010-4554).\n\n Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail\n 1.4.21 and earlier allow remote attackers to inject arbitrary\n web script or HTML via vectors involving (1) drop-down selection\n lists, (2) the > (greater than) character in the SquirrelSpell\n spellchecking plugin, and (3) errors associated with the Index Order\n (aka options_order) page (CVE-2010-4555).\n\n Cross-site scripting (XSS) vulnerability in functions/mime.php in\n SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary\n web script or HTML via a crafted STYLE element in an e-mail message\n (CVE-2011-2023).\n\n CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier\n allows remote attackers to modify or add preference values via a \\n\n (newline) character, a different vulnerability than CVE-2010-4555\n (CVE-2011-2752).\n\n Multiple cross-site request forgery (CSRF) vulnerabilities in\n SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the\n authentication of unspecified victims via vectors involving (1) the\n empty trash implementation and (2) the Index Order (aka options_order)\n page, a different issue than CVE-2010-4555 (CVE-2011-2753).\n\n The updated packages have been upgraded to the 1.4.22 version which\n is not vulnerable to these issues.\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ar\", rpm:\"squirrelmail-ar~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bg\", rpm:\"squirrelmail-bg~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-bangladesh\", rpm:\"squirrelmail-bn-bangladesh~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-india\", rpm:\"squirrelmail-bn-india~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ca\", rpm:\"squirrelmail-ca~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cs\", rpm:\"squirrelmail-cs~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cy\", rpm:\"squirrelmail-cy~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cyrus\", rpm:\"squirrelmail-cyrus~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-da\", rpm:\"squirrelmail-da~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-de\", rpm:\"squirrelmail-de~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-el\", rpm:\"squirrelmail-el~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-es\", rpm:\"squirrelmail-es~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-et\", rpm:\"squirrelmail-et~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-eu\", rpm:\"squirrelmail-eu~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fa\", rpm:\"squirrelmail-fa~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fi\", rpm:\"squirrelmail-fi~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fo\", rpm:\"squirrelmail-fo~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fr\", rpm:\"squirrelmail-fr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fy\", rpm:\"squirrelmail-fy~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-he\", rpm:\"squirrelmail-he~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hr\", rpm:\"squirrelmail-hr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hu\", rpm:\"squirrelmail-hu~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-id\", rpm:\"squirrelmail-id~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-is\", rpm:\"squirrelmail-is~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-it\", rpm:\"squirrelmail-it~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ja\", rpm:\"squirrelmail-ja~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ka\", rpm:\"squirrelmail-ka~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-km\", rpm:\"squirrelmail-km~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ko\", rpm:\"squirrelmail-ko~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lt\", rpm:\"squirrelmail-lt~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lv\", rpm:\"squirrelmail-lv~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-mk\", rpm:\"squirrelmail-mk~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ms\", rpm:\"squirrelmail-ms~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nb\", rpm:\"squirrelmail-nb~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nl\", rpm:\"squirrelmail-nl~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nn\", rpm:\"squirrelmail-nn~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pl\", rpm:\"squirrelmail-pl~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-poutils\", rpm:\"squirrelmail-poutils~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pt\", rpm:\"squirrelmail-pt~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ro\", rpm:\"squirrelmail-ro~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ru\", rpm:\"squirrelmail-ru~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sk\", rpm:\"squirrelmail-sk~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sl\", rpm:\"squirrelmail-sl~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sr\", rpm:\"squirrelmail-sr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sv\", rpm:\"squirrelmail-sv~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ta\", rpm:\"squirrelmail-ta~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-th\", rpm:\"squirrelmail-th~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-tr\", rpm:\"squirrelmail-tr~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ug\", rpm:\"squirrelmail-ug~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-uk\", rpm:\"squirrelmail-uk~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-vi\", rpm:\"squirrelmail-vi~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_CN\", rpm:\"squirrelmail-zh_CN~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_TW\", rpm:\"squirrelmail-zh_TW~1.4.22~0.2mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-07-25T10:55:22", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2011-07-27T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2011-9309", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:863382", "href": "http://plugins.openvas.org/nasl.php?oid=863382", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2011-9309\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 14\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062983.html\");\n script_id(863382);\n script_version(\"$Revision: 6626 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:30:10 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-07-27 14:47:11 +0200 (Wed, 27 Jul 2011)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"FEDORA\", value: \"2011-9309\");\n script_cve_id(\"CVE-2011-2023\", \"CVE-2010-4555\", \"CVE-2010-4554\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2011-9309\");\n\n script_summary(\"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.22~2.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:39:32", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-07-27T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2011-9309", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310863382", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310863382", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2011-9309\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062983.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.863382\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-07-27 14:47:11 +0200 (Wed, 27 Jul 2011)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name:\"FEDORA\", value:\"2011-9309\");\n script_cve_id(\"CVE-2011-2023\", \"CVE-2010-4555\", \"CVE-2010-4554\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2011-9309\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC14\");\n script_tag(name:\"affected\", value:\"squirrelmail on Fedora 14\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.22~2.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2017-07-25T10:55:53", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2011-07-27T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2011-9311", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:863384", "href": "http://plugins.openvas.org/nasl.php?oid=863384", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2011-9311\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 15\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062939.html\");\n script_id(863384);\n script_version(\"$Revision: 6626 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:30:10 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-07-27 14:47:11 +0200 (Wed, 27 Jul 2011)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name: \"FEDORA\", value: \"2011-9311\");\n script_cve_id(\"CVE-2011-2023\", \"CVE-2010-4555\", \"CVE-2010-4554\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2011-9311\");\n\n script_summary(\"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC15\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.22~2.fc15\", rls:\"FC15\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:39:35", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-07-27T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2011-9311", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310863384", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310863384", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2011-9311\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062939.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.863384\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-07-27 14:47:11 +0200 (Wed, 27 Jul 2011)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_xref(name:\"FEDORA\", value:\"2011-9311\");\n script_cve_id(\"CVE-2011-2023\", \"CVE-2010-4555\", \"CVE-2010-4554\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2011-9311\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC15\");\n script_tag(name:\"affected\", value:\"squirrelmail on Fedora 15\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC15\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.22~2.fc15\", rls:\"FC15\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2017-12-20T13:18:38", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-08-13T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-11410", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2010-1637"], "modified": "2017-12-19T00:00:00", "id": "OPENVAS:862307", "href": "http://plugins.openvas.org/nasl.php?oid=862307", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-11410\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 12\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html\");\n script_id(862307);\n script_version(\"$Revision: 8164 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-19 07:30:41 +0100 (Tue, 19 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-13 14:24:53 +0200 (Fri, 13 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2010-11410\");\n script_cve_id(\"CVE-2010-2813\", \"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-11410\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.21~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-01-02T10:54:39", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-08-13T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-11422", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2010-1637"], "modified": "2017-12-25T00:00:00", "id": "OPENVAS:862309", "href": "http://plugins.openvas.org/nasl.php?oid=862309", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-11422\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 13\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html\");\n script_id(862309);\n script_version(\"$Revision: 8243 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-25 07:30:04 +0100 (Mon, 25 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-13 14:24:53 +0200 (Fri, 13 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2010-11422\");\n script_cve_id(\"CVE-2010-2813\", \"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-11422\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.21~1.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-01-11T11:04:44", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-08-13T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-11410", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2010-1637"], "modified": "2018-01-10T00:00:00", "id": "OPENVAS:1361412562310862307", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862307", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-11410\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 12\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862307\");\n script_version(\"$Revision: 8356 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-10 09:00:39 +0100 (Wed, 10 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-13 14:24:53 +0200 (Fri, 13 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2010-11410\");\n script_cve_id(\"CVE-2010-2813\", \"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-11410\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.21~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-01-23T13:05:47", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-08-13T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-11422", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2010-1637"], "modified": "2018-01-23T00:00:00", "id": "OPENVAS:1361412562310862309", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862309", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-11422\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 13\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862309\");\n script_version(\"$Revision: 8495 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-23 08:57:49 +0100 (Tue, 23 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-13 14:24:53 +0200 (Fri, 13 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2010-11422\");\n script_cve_id(\"CVE-2010-2813\", \"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-11422\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.21~1.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-12-18T10:58:35", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-10244", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2017-12-18T00:00:00", "id": "OPENVAS:862178", "href": "http://plugins.openvas.org/nasl.php?oid=862178", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-10244\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 12\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.html\");\n script_id(862178);\n script_version(\"$Revision: 8153 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-18 07:30:39 +0100 (Mon, 18 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-10244\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-10244\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.20~3.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-02T10:54:57", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-10264", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2018-01-01T00:00:00", "id": "OPENVAS:1361412562310862181", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862181", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-10264\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 11\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862181\");\n script_version(\"$Revision: 8266 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-01 08:28:32 +0100 (Mon, 01 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-10264\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-10264\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC11\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.20~2.fc11\", rls:\"FC11\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-12-21T11:32:48", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-10259", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2017-12-20T00:00:00", "id": "OPENVAS:862196", "href": "http://plugins.openvas.org/nasl.php?oid=862196", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-10259\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 13\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.html\");\n script_id(862196);\n script_version(\"$Revision: 8186 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-20 07:30:34 +0100 (Wed, 20 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-10259\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-10259\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.20~3.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-12-14T11:48:53", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2017-12-14T00:00:00", "id": "OPENVAS:831095", "href": "http://plugins.openvas.org/nasl.php?oid=831095", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability was reported in the SquirrelMail Mail Fetch plugin,\n wherein (when the plugin is activated by the administrator) a user\n is allowed to specify (without restriction) any port number for their\n external POP account settings. While the intention is to allow users\n to access POP3 servers using non-standard ports, this also allows\n malicious users to effectively port-scan any server through their\n SquirrelMail service (especially note that when a SquirrelMail server\n resides on a network behind a firewall, it may allow the user to\n explore the network topography (DNS scan) and services available\n (port scan) on the inside of (behind) that firewall). As this\n vulnerability is only exploitable post-authentication, and better\n more specific port scanning tools are freely available, we consider\n this vulnerability to be of very low severity. It has been fixed by\n restricting the allowable POP port numbers (with an administrator\n configuration override available) (CVE-2010-1637).\n\n The updated packages have been patched to correct this issue.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"squirrelmail on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-06/msg00023.php\");\n script_id(831095);\n script_version(\"$Revision: 8109 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-14 07:31:15 +0100 (Thu, 14 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"MDVSA\", value: \"2010:120\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ar\", rpm:\"squirrelmail-ar~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bg\", rpm:\"squirrelmail-bg~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn\", rpm:\"squirrelmail-bn~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ca\", rpm:\"squirrelmail-ca~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cs\", rpm:\"squirrelmail-cs~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cy\", rpm:\"squirrelmail-cy~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cyrus\", rpm:\"squirrelmail-cyrus~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-da\", rpm:\"squirrelmail-da~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-de\", rpm:\"squirrelmail-de~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-el\", rpm:\"squirrelmail-el~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-en\", rpm:\"squirrelmail-en~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-es\", rpm:\"squirrelmail-es~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-et\", rpm:\"squirrelmail-et~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-eu\", rpm:\"squirrelmail-eu~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fa\", rpm:\"squirrelmail-fa~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fi\", rpm:\"squirrelmail-fi~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fo\", rpm:\"squirrelmail-fo~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fr\", rpm:\"squirrelmail-fr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fy\", rpm:\"squirrelmail-fy~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-he\", rpm:\"squirrelmail-he~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hr\", rpm:\"squirrelmail-hr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hu\", rpm:\"squirrelmail-hu~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-id\", rpm:\"squirrelmail-id~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-is\", rpm:\"squirrelmail-is~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-it\", rpm:\"squirrelmail-it~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ja\", rpm:\"squirrelmail-ja~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ka\", rpm:\"squirrelmail-ka~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ko\", rpm:\"squirrelmail-ko~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lt\", rpm:\"squirrelmail-lt~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ms\", rpm:\"squirrelmail-ms~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nb\", rpm:\"squirrelmail-nb~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nl\", rpm:\"squirrelmail-nl~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nn\", rpm:\"squirrelmail-nn~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pl\", rpm:\"squirrelmail-pl~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-poutils\", rpm:\"squirrelmail-poutils~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pt\", rpm:\"squirrelmail-pt~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ro\", rpm:\"squirrelmail-ro~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ru\", rpm:\"squirrelmail-ru~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sk\", rpm:\"squirrelmail-sk~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sl\", rpm:\"squirrelmail-sl~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sr\", rpm:\"squirrelmail-sr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sv\", rpm:\"squirrelmail-sv~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-th\", rpm:\"squirrelmail-th~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-tr\", rpm:\"squirrelmail-tr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ug\", rpm:\"squirrelmail-ug~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-uk\", rpm:\"squirrelmail-uk~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-vi\", rpm:\"squirrelmail-vi~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_CN\", rpm:\"squirrelmail-zh_CN~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_TW\", rpm:\"squirrelmail-zh_TW~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-02T10:54:30", "description": "Check for the Version of openoffice.org-voikko", "cvss3": {}, "published": "2010-04-19T00:00:00", "type": "openvas", "title": "Mandriva Update for openoffice.org-voikko MDVA-2010:120 (openoffice.org-voikko)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2017-12-25T00:00:00", "id": "OPENVAS:830985", "href": "http://plugins.openvas.org/nasl.php?oid=830985", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for openoffice.org-voikko MDVA-2010:120 (openoffice.org-voikko)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"openoffice.org-voikko on Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64\";\ntag_insight = \"This update provides openoffice.org-voikko package for the last\n OpenOffice.org 3.1.1 update.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-04/msg00019.php\");\n script_id(830985);\n script_version(\"$Revision: 8243 $\");\n script_cve_id(\"CVE-2010-1637\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-25 07:30:04 +0100 (Mon, 25 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-04-19 16:47:49 +0200 (Mon, 19 Apr 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"MDVA\", value: \"2010:120\");\n script_name(\"Mandriva Update for openoffice.org-voikko MDVA-2010:120 (openoffice.org-voikko)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of openoffice.org-voikko\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"openoffice.org-voikko\", rpm:\"openoffice.org-voikko~3.1~3.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-18T11:04:53", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-10259", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2018-01-17T00:00:00", "id": "OPENVAS:1361412562310862196", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862196", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-10259\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 13\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862196\");\n script_version(\"$Revision: 8447 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 17:12:19 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-10259\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-10259\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.20~3.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2019-05-29T18:40:06", "description": "SquirrelMail is prone to a remote information-disclosure\n vulnerability.", "cvss3": {}, "published": "2010-06-22T00:00:00", "type": "openvas", "title": "SquirrelMail 'mail_fetch' Remote Information Disclosure Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2019-03-07T00:00:00", "id": "OPENVAS:1361412562310100688", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100688", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_SquirrelMail_40291.nasl 14033 2019-03-07 11:09:35Z cfischer $\n#\n# SquirrelMail 'mail_fetch' Remote Information Disclosure Vulnerability\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:squirrelmail:squirrelmail';\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100688\");\n script_version(\"$Revision: 14033 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-07 12:09:35 +0100 (Thu, 07 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-22 12:10:21 +0200 (Tue, 22 Jun 2010)\");\n script_bugtraq_id(40291);\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"SquirrelMail 'mail_fetch' Remote Information Disclosure Vulnerability\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2010 Greenbone Networks GmbH\");\n script_dependencies(\"squirrelmail_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"squirrelmail/installed\");\n\n script_xref(name:\"URL\", value:\"https://www.securityfocus.com/bid/40291\");\n script_xref(name:\"URL\", value:\"http://permalink.gmane.org/gmane.comp.security.oss.general/2935\");\n script_xref(name:\"URL\", value:\"http://permalink.gmane.org/gmane.comp.security.oss.general/3064\");\n script_xref(name:\"URL\", value:\"http://permalink.gmane.org/gmane.comp.security.oss.general/2936\");\n script_xref(name:\"URL\", value:\"http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69\");\n script_xref(name:\"URL\", value:\"http://www.squirrelmail.org\");\n\n script_tag(name:\"impact\", value:\"Attackers can exploit this issue to obtain potentially sensitive\n information that may lead to further attacks.\");\n\n script_tag(name:\"affected\", value:\"This issue affects SquirrelMail 1.4.x versions.\");\n\n script_tag(name:\"solution\", value:\"Updates are available. Please see the references for more information.\");\n\n script_tag(name:\"summary\", value:\"SquirrelMail is prone to a remote information-disclosure\n vulnerability.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! port = get_app_port( cpe:CPE ) )\n exit( 0 );\n\nif( ! vers = get_app_version( cpe:CPE, port:port ) )\n exit( 0 );\n\nif( version_in_range( version:vers, test_version:\"1.4\", test_version2:\"1.4.20\" ) ||\n version_in_range( version:vers, test_version:\"1.5\", test_version2:\"1.5.1\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.4.21/1.5.2\" );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2017-12-15T11:58:24", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-10264", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2017-12-15T00:00:00", "id": "OPENVAS:862181", "href": "http://plugins.openvas.org/nasl.php?oid=862181", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-10264\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 11\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.html\");\n script_id(862181);\n script_version(\"$Revision: 8130 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-15 07:31:09 +0100 (Fri, 15 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-10264\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-10264\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC11\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.20~2.fc11\", rls:\"FC11\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-11T11:04:54", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Fedora Update for squirrelmail FEDORA-2010-10244", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2018-01-09T00:00:00", "id": "OPENVAS:1361412562310862178", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862178", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for squirrelmail FEDORA-2010-10244\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"squirrelmail on Fedora 12\";\ntag_insight = \"SquirrelMail is a basic webmail package written in PHP4. It\n includes built-in pure PHP support for the IMAP and SMTP protocols, and\n all pages render in pure HTML 4.0 (with no JavaScript) for maximum\n compatibility across browsers. It has very few requirements and is very\n easy to configure and install.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862178\");\n script_version(\"$Revision: 8338 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-09 09:00:38 +0100 (Tue, 09 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"FEDORA\", value: \"2010-10244\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Fedora Update for squirrelmail FEDORA-2010-10244\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.20~3.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-25T10:55:11", "description": "Check for the Version of openoffice.org-voikko", "cvss3": {}, "published": "2010-04-19T00:00:00", "type": "openvas", "title": "Mandriva Update for openoffice.org-voikko MDVA-2010:120 (openoffice.org-voikko)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2018-01-24T00:00:00", "id": "OPENVAS:1361412562310830985", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830985", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for openoffice.org-voikko MDVA-2010:120 (openoffice.org-voikko)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"openoffice.org-voikko on Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64\";\ntag_insight = \"This update provides openoffice.org-voikko package for the last\n OpenOffice.org 3.1.1 update.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-04/msg00019.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830985\");\n script_version(\"$Revision: 8510 $\");\n script_cve_id(\"CVE-2010-1637\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-24 08:57:42 +0100 (Wed, 24 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-04-19 16:47:49 +0200 (Mon, 19 Apr 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"MDVA\", value: \"2010:120\");\n script_name(\"Mandriva Update for openoffice.org-voikko MDVA-2010:120 (openoffice.org-voikko)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of openoffice.org-voikko\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"openoffice.org-voikko\", rpm:\"openoffice.org-voikko~3.1~3.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-02T10:54:42", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-06-25T00:00:00", "type": "openvas", "title": "Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2017-12-29T00:00:00", "id": "OPENVAS:1361412562310831095", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831095", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability was reported in the SquirrelMail Mail Fetch plugin,\n wherein (when the plugin is activated by the administrator) a user\n is allowed to specify (without restriction) any port number for their\n external POP account settings. While the intention is to allow users\n to access POP3 servers using non-standard ports, this also allows\n malicious users to effectively port-scan any server through their\n SquirrelMail service (especially note that when a SquirrelMail server\n resides on a network behind a firewall, it may allow the user to\n explore the network topography (DNS scan) and services available\n (port scan) on the inside of (behind) that firewall). As this\n vulnerability is only exploitable post-authentication, and better\n more specific port scanning tools are freely available, we consider\n this vulnerability to be of very low severity. It has been fixed by\n restricting the allowable POP port numbers (with an administrator\n configuration override available) (CVE-2010-1637).\n\n The updated packages have been patched to correct this issue.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"squirrelmail on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-06/msg00023.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831095\");\n script_version(\"$Revision: 8258 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-29 08:28:57 +0100 (Fri, 29 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-06-25 12:25:26 +0200 (Fri, 25 Jun 2010)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_xref(name: \"MDVSA\", value: \"2010:120\");\n script_cve_id(\"CVE-2010-1637\");\n script_name(\"Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ar\", rpm:\"squirrelmail-ar~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bg\", rpm:\"squirrelmail-bg~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn\", rpm:\"squirrelmail-bn~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ca\", rpm:\"squirrelmail-ca~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cs\", rpm:\"squirrelmail-cs~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cy\", rpm:\"squirrelmail-cy~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cyrus\", rpm:\"squirrelmail-cyrus~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-da\", rpm:\"squirrelmail-da~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-de\", rpm:\"squirrelmail-de~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-el\", rpm:\"squirrelmail-el~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-en\", rpm:\"squirrelmail-en~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-es\", rpm:\"squirrelmail-es~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-et\", rpm:\"squirrelmail-et~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-eu\", rpm:\"squirrelmail-eu~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fa\", rpm:\"squirrelmail-fa~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fi\", rpm:\"squirrelmail-fi~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fo\", rpm:\"squirrelmail-fo~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fr\", rpm:\"squirrelmail-fr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fy\", rpm:\"squirrelmail-fy~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-he\", rpm:\"squirrelmail-he~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hr\", rpm:\"squirrelmail-hr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hu\", rpm:\"squirrelmail-hu~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-id\", rpm:\"squirrelmail-id~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-is\", rpm:\"squirrelmail-is~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-it\", rpm:\"squirrelmail-it~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ja\", rpm:\"squirrelmail-ja~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ka\", rpm:\"squirrelmail-ka~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ko\", rpm:\"squirrelmail-ko~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lt\", rpm:\"squirrelmail-lt~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ms\", rpm:\"squirrelmail-ms~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nb\", rpm:\"squirrelmail-nb~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nl\", rpm:\"squirrelmail-nl~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nn\", rpm:\"squirrelmail-nn~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pl\", rpm:\"squirrelmail-pl~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-poutils\", rpm:\"squirrelmail-poutils~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pt\", rpm:\"squirrelmail-pt~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ro\", rpm:\"squirrelmail-ro~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ru\", rpm:\"squirrelmail-ru~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sk\", rpm:\"squirrelmail-sk~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sl\", rpm:\"squirrelmail-sl~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sr\", rpm:\"squirrelmail-sr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sv\", rpm:\"squirrelmail-sv~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-th\", rpm:\"squirrelmail-th~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-tr\", rpm:\"squirrelmail-tr~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ug\", rpm:\"squirrelmail-ug~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-uk\", rpm:\"squirrelmail-uk~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-vi\", rpm:\"squirrelmail-vi~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_CN\", rpm:\"squirrelmail-zh_CN~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_TW\", rpm:\"squirrelmail-zh_TW~1.4.19~2.3mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-01-18T11:05:07", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-08-30T00:00:00", "type": "openvas", "title": "Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813"], "modified": "2018-01-17T00:00:00", "id": "OPENVAS:1361412562310831136", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831136", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability has been found and corrected in squirrelmail:\n\n functions/imap_general.php in SquirrelMail before 1.4.21 does not\n properly handle 8-bit characters in passwords, which allows remote\n attackers to cause a denial of service (disk consumption) by making\n many IMAP login attempts with different usernames, leading to the\n creation of many preferences files (CVE-2010-2813).\n \n This update provides squirrelmail 1.4.21, which is not vulnerable to\n this issue.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"squirrelmail on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-08/msg00018.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831136\");\n script_version(\"$Revision: 8447 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 17:12:19 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-30 16:59:25 +0200 (Mon, 30 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDVSA\", value: \"2010:158\");\n script_cve_id(\"CVE-2010-2813\");\n script_name(\"Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ar\", rpm:\"squirrelmail-ar~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bg\", rpm:\"squirrelmail-bg~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-bangladesh\", rpm:\"squirrelmail-bn-bangladesh~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-india\", rpm:\"squirrelmail-bn-india~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ca\", rpm:\"squirrelmail-ca~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cs\", rpm:\"squirrelmail-cs~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cy\", rpm:\"squirrelmail-cy~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cyrus\", rpm:\"squirrelmail-cyrus~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-da\", rpm:\"squirrelmail-da~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-de\", rpm:\"squirrelmail-de~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-el\", rpm:\"squirrelmail-el~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-es\", rpm:\"squirrelmail-es~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-et\", rpm:\"squirrelmail-et~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-eu\", rpm:\"squirrelmail-eu~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fa\", rpm:\"squirrelmail-fa~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fi\", rpm:\"squirrelmail-fi~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fo\", rpm:\"squirrelmail-fo~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fr\", rpm:\"squirrelmail-fr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fy\", rpm:\"squirrelmail-fy~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-he\", rpm:\"squirrelmail-he~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hr\", rpm:\"squirrelmail-hr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hu\", rpm:\"squirrelmail-hu~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-id\", rpm:\"squirrelmail-id~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-is\", rpm:\"squirrelmail-is~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-it\", rpm:\"squirrelmail-it~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ja\", rpm:\"squirrelmail-ja~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ka\", rpm:\"squirrelmail-ka~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-km\", rpm:\"squirrelmail-km~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ko\", rpm:\"squirrelmail-ko~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lt\", rpm:\"squirrelmail-lt~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lv\", rpm:\"squirrelmail-lv~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-mk\", rpm:\"squirrelmail-mk~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ms\", rpm:\"squirrelmail-ms~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nb\", rpm:\"squirrelmail-nb~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nl\", rpm:\"squirrelmail-nl~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nn\", rpm:\"squirrelmail-nn~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pl\", rpm:\"squirrelmail-pl~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-poutils\", rpm:\"squirrelmail-poutils~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pt\", rpm:\"squirrelmail-pt~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ro\", rpm:\"squirrelmail-ro~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ru\", rpm:\"squirrelmail-ru~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sk\", rpm:\"squirrelmail-sk~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sl\", rpm:\"squirrelmail-sl~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sr\", rpm:\"squirrelmail-sr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sv\", rpm:\"squirrelmail-sv~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ta\", rpm:\"squirrelmail-ta~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-th\", rpm:\"squirrelmail-th~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-tr\", rpm:\"squirrelmail-tr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ug\", rpm:\"squirrelmail-ug~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-uk\", rpm:\"squirrelmail-uk~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-vi\", rpm:\"squirrelmail-vi~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_CN\", rpm:\"squirrelmail-zh_CN~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_TW\", rpm:\"squirrelmail-zh_TW~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:40:08", "description": "SquirrelMail is prone to a remote denial-of-service vulnerability\n because it fails to properly handle certain user requests.", "cvss3": {}, "published": "2010-08-13T00:00:00", "type": "openvas", "title": "SquirrelMail Remote Denial of Service Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813"], "modified": "2019-03-07T00:00:00", "id": "OPENVAS:1361412562310100759", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100759", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_SquirrelMail_42399.nasl 14033 2019-03-07 11:09:35Z cfischer $\n#\n# SquirrelMail Remote Denial of Service Vulnerability\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:squirrelmail:squirrelmail';\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100759\");\n script_version(\"$Revision: 14033 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-07 12:09:35 +0100 (Thu, 07 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-13 12:44:16 +0200 (Fri, 13 Aug 2010)\");\n script_bugtraq_id(42399);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_cve_id(\"CVE-2010-2813\");\n script_name(\"SquirrelMail Remote Denial of Service Vulnerability\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2010 Greenbone Networks GmbH\");\n script_dependencies(\"squirrelmail_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"squirrelmail/installed\");\n\n script_xref(name:\"URL\", value:\"https://www.securityfocus.com/bid/42399\");\n script_xref(name:\"URL\", value:\"http://www.squirrelmail.org/\");\n script_xref(name:\"URL\", value:\"http://www.squirrelmail.org/security/issue/2010-07-23\");\n script_xref(name:\"URL\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=618096\");\n\n script_tag(name:\"impact\", value:\"An attacker can exploit this issue to cause the application to consume\n excessive disk space, resulting in denial-of-service conditions.\");\n\n script_tag(name:\"affected\", value:\"SquirrelMail versions prior and up to 1.4.20 are vulnerable. Others\n may also be affected.\");\n\n script_tag(name:\"solution\", value:\"Updates are available. Please see the references for more information.\");\n\n script_tag(name:\"summary\", value:\"SquirrelMail is prone to a remote denial-of-service vulnerability\n because it fails to properly handle certain user requests.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! port = get_app_port( cpe:CPE ) )\n exit( 0 );\n\nif( ! vers = get_app_version( cpe:CPE, port:port ) )\n exit( 0 );\n\nif( version_is_less( version:vers, test_version:\"1.4.21\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.4.21\" );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2017-12-21T11:33:05", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2010-08-30T00:00:00", "type": "openvas", "title": "Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813"], "modified": "2017-12-20T00:00:00", "id": "OPENVAS:831136", "href": "http://plugins.openvas.org/nasl.php?oid=831136", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability has been found and corrected in squirrelmail:\n\n functions/imap_general.php in SquirrelMail before 1.4.21 does not\n properly handle 8-bit characters in passwords, which allows remote\n attackers to cause a denial of service (disk consumption) by making\n many IMAP login attempts with different usernames, leading to the\n creation of many preferences files (CVE-2010-2813).\n \n This update provides squirrelmail 1.4.21, which is not vulnerable to\n this issue.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"squirrelmail on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-08/msg00018.php\");\n script_id(831136);\n script_version(\"$Revision: 8186 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-20 07:30:34 +0100 (Wed, 20 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-30 16:59:25 +0200 (Mon, 30 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDVSA\", value: \"2010:158\");\n script_cve_id(\"CVE-2010-2813\");\n script_name(\"Mandriva Update for squirrelmail MDVSA-2010:158 (squirrelmail)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ar\", rpm:\"squirrelmail-ar~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bg\", rpm:\"squirrelmail-bg~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-bangladesh\", rpm:\"squirrelmail-bn-bangladesh~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-bn-india\", rpm:\"squirrelmail-bn-india~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ca\", rpm:\"squirrelmail-ca~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cs\", rpm:\"squirrelmail-cs~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cy\", rpm:\"squirrelmail-cy~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-cyrus\", rpm:\"squirrelmail-cyrus~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-da\", rpm:\"squirrelmail-da~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-de\", rpm:\"squirrelmail-de~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-el\", rpm:\"squirrelmail-el~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-es\", rpm:\"squirrelmail-es~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-et\", rpm:\"squirrelmail-et~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-eu\", rpm:\"squirrelmail-eu~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fa\", rpm:\"squirrelmail-fa~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fi\", rpm:\"squirrelmail-fi~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fo\", rpm:\"squirrelmail-fo~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fr\", rpm:\"squirrelmail-fr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-fy\", rpm:\"squirrelmail-fy~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-he\", rpm:\"squirrelmail-he~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hr\", rpm:\"squirrelmail-hr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-hu\", rpm:\"squirrelmail-hu~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-id\", rpm:\"squirrelmail-id~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-is\", rpm:\"squirrelmail-is~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-it\", rpm:\"squirrelmail-it~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ja\", rpm:\"squirrelmail-ja~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ka\", rpm:\"squirrelmail-ka~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-km\", rpm:\"squirrelmail-km~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ko\", rpm:\"squirrelmail-ko~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lt\", rpm:\"squirrelmail-lt~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-lv\", rpm:\"squirrelmail-lv~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-mk\", rpm:\"squirrelmail-mk~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ms\", rpm:\"squirrelmail-ms~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nb\", rpm:\"squirrelmail-nb~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nl\", rpm:\"squirrelmail-nl~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-nn\", rpm:\"squirrelmail-nn~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pl\", rpm:\"squirrelmail-pl~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-poutils\", rpm:\"squirrelmail-poutils~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-pt\", rpm:\"squirrelmail-pt~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ro\", rpm:\"squirrelmail-ro~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ru\", rpm:\"squirrelmail-ru~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sk\", rpm:\"squirrelmail-sk~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sl\", rpm:\"squirrelmail-sl~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sr\", rpm:\"squirrelmail-sr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-sv\", rpm:\"squirrelmail-sv~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ta\", rpm:\"squirrelmail-ta~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-th\", rpm:\"squirrelmail-th~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-tr\", rpm:\"squirrelmail-tr~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-ug\", rpm:\"squirrelmail-ug~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-uk\", rpm:\"squirrelmail-uk~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-vi\", rpm:\"squirrelmail-vi~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_CN\", rpm:\"squirrelmail-zh_CN~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"squirrelmail-zh_TW\", rpm:\"squirrelmail-zh_TW~1.4.21~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:51:47", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2013-01-21T00:00:00", "type": "openvas", "title": "CentOS Update for squirrelmail CESA-2013:0126 centos5 ", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-2124", "CVE-2010-2813"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:881572", "href": "http://plugins.openvas.org/nasl.php?oid=881572", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for squirrelmail CESA-2013:0126 centos5 \n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail is a standards-based webmail package written in PHP.\n\n The SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum\n text stated, correct the CVE-2010-2813 issue, a flaw in the way\n SquirrelMail handled failed log in attempts. A user preference file was\n created when attempting to log in with a password containing an 8-bit\n character, even if the username was not valid. A remote attacker could use\n this flaw to eventually consume all hard disk space on the target\n SquirrelMail server. (CVE-2012-2124)\n \n This update also fixes the following bugs:\n \n * Prior to this update, SquirrelMail could not decode multi-line subjects\n properly. Consequently, the decode header internationalization option did\n not properly handle new lines or tabs at the beginning of the lines. This\n bug has been fixed and SquirrelMail now works correctly in the described\n scenario. (BZ#241861)\n \n * Due to a bug, attachments written in HTML code on the Windows operating\n system were not displayed properly when accessed with SquirrelMail; the\n &quot;!=null&quot; string was trimmed to &quot;!ull&quot;. This bug has been fixed and the\n attachments are now displayed correctly in such a case. (BZ#359791)\n \n * Previously, e-mail messages with a Unique Identifier (UID) larger than\n 2^31 bytes were unreadable when using the squirrelmail package. With this\n patch the squirrelmail package is able to read all messages regardless of\n the UIDs size. (BZ#450780)\n \n * Due to a bug, a PHP script did not assign the proper character set to\n requested variables. Consequently, SquirrelMail could not display any\n e-mails. The underlying source code has been modified and now the\n squirrelmail package assigns the correct character set. (BZ#475188)\n \n * Due to the incorrect internationalization option located at the i18n.php\n file, the squirrelmail package could not use the GB 2312 character set. The\n i18n.php file has been fixed and the GB 2312 character set works correctly\n in the described scenario. (BZ#508686)\n \n * Previously, the preg_split() function contained a misspelled constant,\n PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error\n messages. The name of the constant has been corrected to\n PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in\n this scenario. (BZ#528758)\n \n * Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from\n the SquirrelMail web interface was blocked. This update adds a note to the\n SquirrelMail documentation that describes how to set the SELinux options to\n allow sending e-mails from ... \n\n Description truncated, for more information please check the Reference URL\";\n\n\ntag_affected = \"squirrelmail on CentOS 5\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2013-January/019177.html\");\n script_id(881572);\n script_version(\"$Revision: 6655 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:48:58 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-01-21 09:41:41 +0530 (Mon, 21 Jan 2013)\");\n script_cve_id(\"CVE-2012-2124\", \"CVE-2010-2813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"CESA\", value: \"2013:0126\");\n script_name(\"CentOS Update for squirrelmail CESA-2013:0126 centos5 \");\n\n script_summary(\"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~21.el5.centos\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-27T10:51:52", "description": "Check for the Version of squirrelmail", "cvss3": {}, "published": "2013-01-11T00:00:00", "type": "openvas", "title": "RedHat Update for squirrelmail RHSA-2013:0126-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-2124", "CVE-2010-2813"], "modified": "2017-07-12T00:00:00", "id": "OPENVAS:870880", "href": "http://plugins.openvas.org/nasl.php?oid=870880", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for squirrelmail RHSA-2013:0126-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail is a standards-based webmail package written in PHP.\n\n The SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum\n text stated, correct the CVE-2010-2813 issue, a flaw in the way\n SquirrelMail handled failed log in attempts. A user preference file was\n created when attempting to log in with a password containing an 8-bit\n character, even if the username was not valid. A remote attacker could use\n this flaw to eventually consume all hard disk space on the target\n SquirrelMail server. (CVE-2012-2124)\n\n This update also fixes the following bugs:\n\n * Prior to this update, SquirrelMail could not decode multi-line subjects\n properly. Consequently, the decode header internationalization option did\n not properly handle new lines or tabs at the beginning of the lines. This\n bug has been fixed and SquirrelMail now works correctly in the described\n scenario. (BZ#241861)\n\n * Due to a bug, attachments written in HTML code on the Windows operating\n system were not displayed properly when accessed with SquirrelMail; the\n &quot;!=null&quot; string was trimmed to '!ull'. This bug has been fixed and the\n attachments are now displayed correctly in such a case. (BZ#359791)\n\n * Previously, e-mail messages with a Unique Identifier (UID) larger than\n 2^31 bytes were unreadable when using the squirrelmail package. With this\n patch the squirrelmail package is able to read all messages regardless of\n the UIDs size. (BZ#450780)\n\n * Due to a bug, a PHP script did not assign the proper character set to\n requested variables. Consequently, SquirrelMail could not display any\n e-mails. The underlying source code has been modified and now the\n squirrelmail package assigns the correct character set. (BZ#475188)\n\n Description truncated, for more information please check the Reference URL\";\n\n\ntag_affected = \"squirrelmail on Red Hat Enterprise Linux (v. 5 server)\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/rhsa-announce/2013-January/msg00009.html\");\n script_id(870880);\n script_version(\"$Revision: 6687 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:46:43 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-01-11 16:42:08 +0530 (Fri, 11 Jan 2013)\");\n script_cve_id(\"CVE-2012-2124\", \"CVE-2010-2813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"RHSA\", value: \"2013:0126-01\");\n script_name(\"RedHat Update for squirrelmail RHSA-2013:0126-01\");\n\n script_summary(\"Check for the Version of squirrelmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~21.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-01-11T11:04:40", "description": "The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2091-1.", "cvss3": {}, "published": "2010-08-21T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2091-1 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2009-2964"], "modified": "2018-01-09T00:00:00", "id": "OPENVAS:136141256231067845", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231067845", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2091_1.nasl 8338 2018-01-09 08:00:38Z teissa $\n# Description: Auto-generated from advisory DSA 2091-1 (squirrelmail)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail, a webmail application, does not employ a user-specific token\nfor webforms. This allows a remote attacker to perform a Cross Site Request\nForgery (CSRF) attack. The attacker may hijack the authentication of\nunspecified victims and send messages or change user preferences among other\nactions, by tricking the victim into following a link controlled by the\noffender.\n\nIn addition, a denial-of-service was fixed, which could be triggered when a\npasswords containing 8-bit characters was used to log in (CVE-2010-2813).\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny3.1.\n\nFor the testing distribution (squeeze) and the unstable distribution (sid),\nthese problems have been fixed in version 1.4.21-1.\n\nWe recommend that you upgrade your squirrelmail packages.\";\ntag_summary = \"The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2091-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202091-1\";\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.67845\");\n script_version(\"$Revision: 8338 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-09 09:00:38 +0100 (Tue, 09 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-21 08:54:16 +0200 (Sat, 21 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-2964\", \"CVE-2010-2813\");\n script_name(\"Debian Security Advisory DSA 2091-1 (squirrelmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"squirrelmail\", ver:\"1.4.15-4+lenny3.1\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:49:24", "description": "The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2091-1.", "cvss3": {}, "published": "2010-08-21T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2091-1 (squirrelmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2009-2964"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:67845", "href": "http://plugins.openvas.org/nasl.php?oid=67845", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2091_1.nasl 6614 2017-07-07 12:09:12Z cfischer $\n# Description: Auto-generated from advisory DSA 2091-1 (squirrelmail)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SquirrelMail, a webmail application, does not employ a user-specific token\nfor webforms. This allows a remote attacker to perform a Cross Site Request\nForgery (CSRF) attack. The attacker may hijack the authentication of\nunspecified victims and send messages or change user preferences among other\nactions, by tricking the victim into following a link controlled by the\noffender.\n\nIn addition, a denial-of-service was fixed, which could be triggered when a\npasswords containing 8-bit characters was used to log in (CVE-2010-2813).\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny3.1.\n\nFor the testing distribution (squeeze) and the unstable distribution (sid),\nthese problems have been fixed in version 1.4.21-1.\n\nWe recommend that you upgrade your squirrelmail packages.\";\ntag_summary = \"The remote host is missing an update to squirrelmail\nannounced via advisory DSA 2091-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202091-1\";\n\n\nif(description)\n{\n script_id(67845);\n script_version(\"$Revision: 6614 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:12 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-21 08:54:16 +0200 (Sat, 21 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-2964\", \"CVE-2010-2813\");\n script_name(\"Debian Security Advisory DSA 2091-1 (squirrelmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"squirrelmail\", ver:\"1.4.15-4+lenny3.1\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:37:48", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2013-01-21T00:00:00", "type": "openvas", "title": "CentOS Update for squirrelmail CESA-2013:0126 centos5", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-2124", "CVE-2010-2813"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310881572", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881572", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for squirrelmail CESA-2013:0126 centos5\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2013-January/019177.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.881572\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-01-21 09:41:41 +0530 (Mon, 21 Jan 2013)\");\n script_cve_id(\"CVE-2012-2124\", \"CVE-2010-2813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name:\"CESA\", value:\"2013:0126\");\n script_name(\"CentOS Update for squirrelmail CESA-2013:0126 centos5\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS5\");\n script_tag(name:\"affected\", value:\"squirrelmail on CentOS 5\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"insight\", value:\"SquirrelMail is a standards-based webmail package written in PHP.\n\n The SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum\n text stated, correct the CVE-2010-2813 issue, a flaw in the way\n SquirrelMail handled failed log in attempts. A user preference file was\n created when attempting to log in with a password containing an 8-bit\n character, even if the username was not valid. A remote attacker could use\n this flaw to eventually consume all hard disk space on the target\n SquirrelMail server. (CVE-2012-2124)\n\n This update also fixes the following bugs:\n\n * Prior to this update, SquirrelMail could not decode multi-line subjects\n properly. Consequently, the decode header internationalization option did\n not properly handle new lines or tabs at the beginning of the lines. This\n bug has been fixed and SquirrelMail now works correctly in the described\n scenario. (BZ#241861)\n\n * Due to a bug, attachments written in HTML code on the Windows operating\n system were not displayed properly when accessed with SquirrelMail. The\n '!=null' string was trimmed to '!ull'. This bug has been fixed and the\n attachments are now displayed correctly in such a case. (BZ#359791)\n\n * Previously, e-mail messages with a Unique Identifier (UID) larger than\n 2^31 bytes were unreadable when using the squirrelmail package. With this\n patch the squirrelmail package is able to read all messages regardless of\n the UIDs size. (BZ#450780)\n\n * Due to a bug, a PHP script did not assign the proper character set to\n requested variables. Consequently, SquirrelMail could not display any\n e-mails. The underlying source code has been modified and now the\n squirrelmail package assigns the correct character set. (BZ#475188)\n\n * Due to the incorrect internationalization option located at the i18n.php\n file, the squirrelmail package could not use the GB 2312 character set. The\n i18n.php file has been fixed and the GB 2312 character set works correctly\n in the described scenario. (BZ#508686)\n\n * Previously, the preg_split() function contained a misspelled constant,\n PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error\n messages. The name of the constant has been corrected to\n PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in\n this scenario. (BZ#528758)\n\n * Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from\n the SquirrelMail web interface was blocked. This update adds a note to the\n SquirrelMail documentation that describes how to set the SELinux options to\n allow sending e-mails from ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~21.el5.centos\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:37:49", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2013-01-11T00:00:00", "type": "openvas", "title": "RedHat Update for squirrelmail RHSA-2013:0126-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-2124", "CVE-2010-2813"], "modified": "2019-03-12T00:00:00", "id": "OPENVAS:1361412562310870880", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870880", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for squirrelmail RHSA-2013:0126-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2013-January/msg00009.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.870880\");\n script_version(\"$Revision: 14114 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-12 12:48:52 +0100 (Tue, 12 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-01-11 16:42:08 +0530 (Fri, 11 Jan 2013)\");\n script_cve_id(\"CVE-2012-2124\", \"CVE-2010-2813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name:\"RHSA\", value:\"2013:0126-01\");\n script_name(\"RedHat Update for squirrelmail RHSA-2013:0126-01\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'squirrelmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_5\");\n script_tag(name:\"affected\", value:\"squirrelmail on Red Hat Enterprise Linux (v. 5 server)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"SquirrelMail is a standards-based webmail package written in PHP.\n\n The SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum\n text stated, correct the CVE-2010-2813 issue, a flaw in the way\n SquirrelMail handled failed log in attempts. A user preference file was\n created when attempting to log in with a password containing an 8-bit\n character, even if the username was not valid. A remote attacker could use\n this flaw to eventually consume all hard disk space on the target\n SquirrelMail server. (CVE-2012-2124)\n\n This update also fixes the following bugs:\n\n * Prior to this update, SquirrelMail could not decode multi-line subjects\n properly. Consequently, the decode header internationalization option did\n not properly handle new lines or tabs at the beginning of the lines. This\n bug has been fixed and SquirrelMail now works correctly in the described\n scenario. (BZ#241861)\n\n * Due to a bug, attachments written in HTML code on the Windows operating\n system were not displayed properly when accessed with SquirrelMail. The\n '!=null' string was trimmed to '!ull'. This bug has been fixed and the\n attachments are now displayed correctly in such a case. (BZ#359791)\n\n * Previously, e-mail messages with a Unique Identifier (UID) larger than\n 2^31 bytes were unreadable when using the squirrelmail package. With this\n patch the squirrelmail package is able to read all messages regardless of\n the UIDs size. (BZ#450780)\n\n * Due to a bug, a PHP script did not assign the proper character set to\n requested variables. Consequently, SquirrelMail could not display any\n e-mails. The underlying source code has been modified and now the\n squirrelmail package assigns the correct character set. (BZ#475188)\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"squirrelmail\", rpm:\"squirrelmail~1.4.8~21.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-04-26T15:08:42", "description": "This host is missing an important security update according to\n Mac OS X Update/Mac OS X Security Update 2012-001.", "cvss3": {}, "published": "2012-02-06T00:00:00", "type": "openvas", "title": "Mac OS X Multiple Vulnerabilities (2012-001)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-3462", "CVE-2011-3448", "CVE-2011-1148", "CVE-2011-3444", "CVE-2011-1783", "CVE-2011-3246", "CVE-2011-3249", "CVE-2011-3189", "CVE-2011-0241", "CVE-2011-1752", "CVE-2011-1938", "CVE-2011-3449", "CVE-2011-3441", "CVE-2011-3453", "CVE-2011-3422", "CVE-2011-3248", "CVE-2011-2483", "CVE-2011-3457", "CVE-2010-2813", "CVE-2011-3463", "CVE-2011-3389", "CVE-2011-2204", "CVE-2011-3256", "CVE-2011-1657", "CVE-2011-1167", "CVE-2011-3252", "CVE-2011-3268", "CVE-2011-3328", "CVE-2011-2023", "CVE-2011-3182", "CVE-2010-4554", "CVE-2011-1921", "CVE-2011-3459", "CVE-2010-4555", "CVE-2011-3250", "CVE-2011-0200", "CVE-2011-3267", "CVE-2011-3458", "CVE-2011-3447", "CVE-2011-3460", "CVE-2011-3348", "CVE-2011-2202", "CVE-2011-3452", "CVE-2011-3450", "CVE-2011-2895", "CVE-2010-1637", "CVE-2011-2937", "CVE-2011-2192"], "modified": "2020-04-22T00:00:00", "id": "OPENVAS:1361412562310802392", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310802392", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mac OS X Multiple Vulnerabilities (2012-001)\n#\n# Authors:\n# Rachana Shetty <srachana@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.802392\");\n script_version(\"2020-04-22T10:27:30+0000\");\n script_cve_id(\"CVE-2011-3444\", \"CVE-2011-3348\", \"CVE-2011-3389\", \"CVE-2011-3246\",\n \"CVE-2011-3447\", \"CVE-2011-0200\", \"CVE-2011-3252\", \"CVE-2011-3448\",\n \"CVE-2011-3449\", \"CVE-2011-3450\", \"CVE-2011-2192\", \"CVE-2011-2895\",\n \"CVE-2011-3452\", \"CVE-2011-3441\", \"CVE-2011-3453\", \"CVE-2011-3422\",\n \"CVE-2011-3457\", \"CVE-2011-1148\", \"CVE-2011-1657\", \"CVE-2011-1938\",\n \"CVE-2011-2202\", \"CVE-2011-2483\", \"CVE-2011-3182\", \"CVE-2011-3189\",\n \"CVE-2011-3267\", \"CVE-2011-3268\", \"CVE-2011-3256\", \"CVE-2011-3328\",\n \"CVE-2011-3458\", \"CVE-2011-3248\", \"CVE-2011-3459\", \"CVE-2011-3250\",\n \"CVE-2011-3460\", \"CVE-2011-3249\", \"CVE-2010-1637\", \"CVE-2010-2813\",\n \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-1752\",\n \"CVE-2011-1783\", \"CVE-2011-1921\", \"CVE-2011-3462\", \"CVE-2011-2204\",\n \"CVE-2011-3463\", \"CVE-2011-2937\", \"CVE-2011-0241\", \"CVE-2011-1167\");\n script_bugtraq_id(51810, 49616, 49778, 50115, 51813, 48416, 50065, 51817, 51812,\n 51815, 48434, 49124, 48833, 46951, 49744, 51819, 50641, 51807,\n 49429, 51808, 46843, 49252, 47950, 48259, 49241, 49249, 49376,\n 50155, 51809, 50400, 51811, 50401, 51814, 50404, 40291, 42399,\n 48648, 48091, 51818, 48456, 51816, 49229, 47820, 49303, 50092,\n 50112, 50091, 50099, 48007, 48566, 37118);\n script_tag(name:\"last_modification\", value:\"2020-04-22 10:27:30 +0000 (Wed, 22 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2012-02-06 17:42:28 +0530 (Mon, 06 Feb 2012)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mac OS X Multiple Vulnerabilities (2012-001)\");\n script_xref(name:\"URL\", value:\"http://support.apple.com/kb/HT5130\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/47843/\");\n script_xref(name:\"URL\", value:\"http://securitytracker.com/id/1026627\");\n script_xref(name:\"URL\", value:\"http://lists.apple.com/archives/security-announce/2012/Feb/msg00001.html\");\n\n script_copyright(\"Copyright (C) 2012 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.[67]\\.\");\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to execute arbitrary code in\n the context of the browser, inject scripts, bypass certain security\n restrictions or cause a denial-of-service condition.\");\n script_tag(name:\"affected\", value:\"Address Book, Apache, CFNetwork, ColorSync, CoreAudio, CoreText, CoreUI\n curl, Data Security, dovecot, filecmds, ImageIO, Internet Sharing, Libinfo,\n libresolv, libsecurity, OpenGL, PHP, QuickTime, SquirrelMail, X11, Webmail,\n Tomcat, WebDAV Sharing.\");\n script_tag(name:\"insight\", value:\"For more information on the vulnerabilities refer the reference section.\");\n script_tag(name:\"solution\", value:\"Upgrade to Mac OS X 10.7.3 or\n Run Mac Updates and update the Security Update 2012-001\");\n script_tag(name:\"summary\", value:\"This host is missing an important security update according to\n Mac OS X Update/Mac OS X Security Update 2012-001.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"http://support.apple.com/kb/HT1222\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"pkg-lib-macosx.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName)\n exit(0);\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer)\n exit(0);\n\nif(\"Mac OS X\" >< osName)\n{\n if(version_is_equal(version:osVer, test_version:\"10.6.8\"))\n {\n if(isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2012.001\"))\n {\n report = report_fixed_ver(installed_version:osVer, vulnerable_range:\"Equal to 10.6.8\");\n security_message(port:0, data:report);\n exit(0);\n }\n }\n\n if(version_in_range(version:osVer, test_version:\"10.7\", test_version2:\"10.7.2\"))\n {\n report = report_fixed_ver(installed_version:osVer, vulnerable_range:\"10.7 - 10.7.2\");\n security_message(port:0, data:report);\n exit(0);\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-19T10:50:27", "description": "This host is missing an important security update according to\n Mac OS X Update/Mac OS X Security Update 2012-001.", "cvss3": {}, "published": "2012-02-06T00:00:00", "type": "openvas", "title": "Mac OS X Multiple Vulnerabilities (2012-001)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-3462", "CVE-2011-3448", "CVE-2011-1148", "CVE-2011-3444", "CVE-2011-1783", "CVE-2011-3246", "CVE-2011-3249", "CVE-2011-3189", "CVE-2011-0241", "CVE-2011-1752", "CVE-2011-1938", "CVE-2011-3449", "CVE-2011-3441", "CVE-2011-3453", "CVE-2011-3422", "CVE-2011-3248", "CVE-2011-2483", "CVE-2011-3457", "CVE-2010-2813", "CVE-2011-3463", "CVE-2011-3389", "CVE-2011-2204", "CVE-2011-3256", "CVE-2011-1657", "CVE-2011-1167", "CVE-2011-3252", "CVE-2011-3268", "CVE-2011-3328", "CVE-2011-2023", "CVE-2011-3182", "CVE-2010-4554", "CVE-2011-1921", "CVE-2011-3459", "CVE-2010-4555", "CVE-2011-3250", "CVE-2011-0200", "CVE-2011-3267", "CVE-2011-3458", "CVE-2011-3447", "CVE-2011-3460", "CVE-2011-3348", "CVE-2011-2202", "CVE-2011-3452", "CVE-2011-3450", "CVE-2011-2895", "CVE-2010-1637", "CVE-2011-2937", "CVE-2011-2192"], "modified": "2017-07-04T00:00:00", "id": "OPENVAS:802392", "href": "http://plugins.openvas.org/nasl.php?oid=802392", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_macosx_su12-001.nasl 6521 2017-07-04 14:51:10Z cfischer $\n#\n# Mac OS X Multiple Vulnerabilities (2012-001)\n#\n# Authors:\n# Rachana Shetty <srachana@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation could allow attackers to execute arbitrary code in\n the context of the browser, inject scripts, bypass certain security\n restrictions or cause a denial-of-service condition.\n Impact Level: System/Application\";\ntag_affected = \"Address Book, Apache, CFNetwork, ColorSync, CoreAudio, CoreText, CoreUI\n curl, Data Security, dovecot, filecmds, ImageIO, Internet Sharing, Libinfo,\n libresolv, libsecurity, OpenGL, PHP, QuickTime, SquirrelMail, X11, Webmail,\n Tomcat, WebDAV Sharing.\";\ntag_insight = \"For more information on the vulnerabilities refer the reference section.\";\ntag_solution = \"Upgrade to Mac OS X 10.7.3 or\n Run Mac Updates and update the Security Update 2012-001\n For updates refer to http://support.apple.com/kb/HT1222\";\ntag_summary = \"This host is missing an important security update according to\n Mac OS X Update/Mac OS X Security Update 2012-001.\";\n\nif(description)\n{\n script_id(802392);\n script_version(\"$Revision: 6521 $\");\n script_cve_id(\"CVE-2011-3444\", \"CVE-2011-3348\", \"CVE-2011-3389\", \"CVE-2011-3246\",\n \"CVE-2011-3447\", \"CVE-2011-0200\", \"CVE-2011-3252\", \"CVE-2011-3448\",\n \"CVE-2011-3449\", \"CVE-2011-3450\", \"CVE-2011-2192\", \"CVE-2011-2895\",\n \"CVE-2011-3452\", \"CVE-2011-3441\", \"CVE-2011-3453\", \"CVE-2011-3422\",\n \"CVE-2011-3457\", \"CVE-2011-1148\", \"CVE-2011-1657\", \"CVE-2011-1938\",\n \"CVE-2011-2202\", \"CVE-2011-2483\", \"CVE-2011-3182\", \"CVE-2011-3189\",\n \"CVE-2011-3267\", \"CVE-2011-3268\", \"CVE-2011-3256\", \"CVE-2011-3328\",\n \"CVE-2011-3458\", \"CVE-2011-3248\", \"CVE-2011-3459\", \"CVE-2011-3250\",\n \"CVE-2011-3460\", \"CVE-2011-3249\", \"CVE-2010-1637\", \"CVE-2010-2813\",\n \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-1752\",\n \"CVE-2011-1783\", \"CVE-2011-1921\", \"CVE-2011-3462\", \"CVE-2011-2204\",\n \"CVE-2011-3463\", \"CVE-2011-2937\", \"CVE-2011-0241\", \"CVE-2011-1167\");\n script_bugtraq_id(51810, 49616, 49778, 50115, 51813, 48416, 50065, 51817, 51812,\n 51815, 48434, 49124, 48833, 46951, 49744, 51819, 50641, 51807,\n 49429, 51808, 46843, 49252, 47950, 48259, 49241, 49249, 49376,\n 50155, 51809, 50400, 51811, 50401, 51814, 50404, 40291, 42399,\n 48648, 48091, 51818, 48456, 51816, 49229, 47820, 49303, 50092,\n 50112, 50091, 50099, 48007, 48566, 37118);\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-04 16:51:10 +0200 (Tue, 04 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-06 17:42:28 +0530 (Mon, 06 Feb 2012)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mac OS X Multiple Vulnerabilities (2012-001)\");\n script_xref(name : \"URL\" , value : \"http://support.apple.com/kb/HT5130\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/47843/\");\n script_xref(name : \"URL\" , value : \"http://securitytracker.com/id/1026627\");\n script_xref(name : \"URL\" , value : \"http://lists.apple.com/archives/security-announce/2012/Feb/msg00001.html\");\n\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\ninclude(\"pkg-lib-macosx.inc\");\n\n## Variables Initialization\nosName = \"\";\nosVer = NULL;\n\n## Get the OS name\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName){\n exit (0);\n}\n\n## Get the OS Version\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer){\n exit(0);\n}\n\n## Check for the Mac OS X and Mac OS X Server\nif(\"Mac OS X\" >< osName)\n{\n ## Check the affected OS versions\n if(version_is_equal(version:osVer, test_version:\"10.6.8\"))\n {\n ## Check for the security update 2011.006\n if(isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2012.001\"))\n {\n security_message(0);\n exit(0);\n }\n }\n\n ## Check if OS is 10.7 through 10.7.2\n if(version_in_range(version:osVer, test_version:\"10.7\", test_version2:\"10.7.2\"))\n {\n security_message(0);\n exit(0);\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2023-12-05T14:48:38", "description": "SquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data. With this update, the SquirrelMail main frame can only be loaded into the top most browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2012-08-01T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : squirrelmail on SL4.x, SL5.x (20120208)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:squirrelmail", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20120208_SQUIRRELMAIL_ON_SL4_X.NASL", "href": "https://www.tenable.com/plugins/nessus/61240", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(61240);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n\n script_name(english:\"Scientific Linux Security Update : squirrelmail on SL4.x, SL5.x (20120208)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Scientific Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"SquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail\nperformed the sanitization of HTML style tag content. A remote\nattacker could use this flaw to send a specially crafted Multipurpose\nInternet Mail Extensions (MIME) message that, when opened by a victim,\nwould lead to arbitrary web script execution in the context of their\nSquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary\nweb script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled\nthe content of various HTML input fields. A remote attacker could use\nthis flaw to alter user preference values via a newline character\ncontained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages\ndid not protect against Cross-Site Request Forgery (CSRF) attacks. If\na remote attacker could trick a user, who was logged into\nSquirrelMail, into visiting a specially crafted URL, the attacker\ncould empty the victim's trash folder or alter the ordering of the\ncolumns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing\na remote attacker to perform a clickjacking attack against logged in\nusers and possibly gain access to sensitive user data. With this\nupdate, the SquirrelMail main frame can only be loaded into the top\nmost browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in\nattempts. A user preference file was created when attempting to log in\nwith a password containing an 8-bit character, even if the username\nwas not valid. A remote attacker could use this flaw to eventually\nconsume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an\nadministrator enabled this plug-in, a SquirrelMail user could use this\nflaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which\ncontains backported patches to correct these issues.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1202&L=scientific-linux-errata&T=0&P=1503\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4287bf21\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 4.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL4\", reference:\"squirrelmail-1.4.8-18.el4\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-04T14:08:07", "description": "An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data. With this update, the SquirrelMail main frame can only be loaded into the top most browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2012-02-09T00:00:00", "type": "nessus", "title": "CentOS 4 / 5 : squirrelmail (CESA-2012:0103)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:squirrelmail", "cpe:/o:centos:centos:4", "cpe:/o:centos:centos:5"], "id": "CENTOS_RHSA-2012-0103.NASL", "href": "https://www.tenable.com/plugins/nessus/57864", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2012:0103 and \n# CentOS Errata and Security Advisory 2012:0103 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57864);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_bugtraq_id(40291, 42399, 48648);\n script_xref(name:\"RHSA\", value:\"2012:0103\");\n\n script_name(english:\"CentOS 4 / 5 : squirrelmail (CESA-2012:0103)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated squirrelmail package that fixes several security issues is\nnow available for Red Hat Enterprise Linux 4 and 5.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail\nperformed the sanitization of HTML style tag content. A remote\nattacker could use this flaw to send a specially crafted Multipurpose\nInternet Mail Extensions (MIME) message that, when opened by a victim,\nwould lead to arbitrary web script execution in the context of their\nSquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary\nweb script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled\nthe content of various HTML input fields. A remote attacker could use\nthis flaw to alter user preference values via a newline character\ncontained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages\ndid not protect against Cross-Site Request Forgery (CSRF) attacks. If\na remote attacker could trick a user, who was logged into\nSquirrelMail, into visiting a specially crafted URL, the attacker\ncould empty the victim's trash folder or alter the ordering of the\ncolumns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing\na remote attacker to perform a clickjacking attack against logged in\nusers and possibly gain access to sensitive user data. With this\nupdate, the SquirrelMail main frame can only be loaded into the top\nmost browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in\nattempts. A user preference file was created when attempting to log in\nwith a password containing an 8-bit character, even if the username\nwas not valid. A remote attacker could use this flaw to eventually\nconsume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an\nadministrator enabled this plug-in, a SquirrelMail user could use this\nflaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which\ncontains backported patches to correct these issues.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2012-February/018422.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7450a5dc\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2012-February/018423.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?585ff16c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2011-2753\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 4.x / 5.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"squirrelmail-1.4.8-18.el4.centos\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"squirrelmail-1.4.8-18.el4.centos\")) flag++;\n\nif (rpm_check(release:\"CentOS-5\", reference:\"squirrelmail-1.4.8-5.el5.centos.13\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:18:36", "description": "From Red Hat Security Advisory 2012:0103 :\n\nAn updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data. With this update, the SquirrelMail main frame can only be loaded into the top most browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2013-07-12T00:00:00", "type": "nessus", "title": "Oracle Linux 4 / 5 : squirrelmail (ELSA-2012-0103)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:squirrelmail", "cpe:/o:oracle:linux:4", "cpe:/o:oracle:linux:5"], "id": "ORACLELINUX_ELSA-2012-0103.NASL", "href": "https://www.tenable.com/plugins/nessus/68452", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2012:0103 and \n# Oracle Linux Security Advisory ELSA-2012-0103 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(68452);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_bugtraq_id(40291, 42399, 48648);\n script_xref(name:\"RHSA\", value:\"2012:0103\");\n\n script_name(english:\"Oracle Linux 4 / 5 : squirrelmail (ELSA-2012-0103)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2012:0103 :\n\nAn updated squirrelmail package that fixes several security issues is\nnow available for Red Hat Enterprise Linux 4 and 5.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail\nperformed the sanitization of HTML style tag content. A remote\nattacker could use this flaw to send a specially crafted Multipurpose\nInternet Mail Extensions (MIME) message that, when opened by a victim,\nwould lead to arbitrary web script execution in the context of their\nSquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary\nweb script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled\nthe content of various HTML input fields. A remote attacker could use\nthis flaw to alter user preference values via a newline character\ncontained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages\ndid not protect against Cross-Site Request Forgery (CSRF) attacks. If\na remote attacker could trick a user, who was logged into\nSquirrelMail, into visiting a specially crafted URL, the attacker\ncould empty the victim's trash folder or alter the ordering of the\ncolumns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing\na remote attacker to perform a clickjacking attack against logged in\nusers and possibly gain access to sensitive user data. With this\nupdate, the SquirrelMail main frame can only be loaded into the top\nmost browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in\nattempts. A user preference file was created when attempting to log in\nwith a password containing an 8-bit character, even if the username\nwas not valid. A remote attacker could use this flaw to eventually\nconsume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an\nadministrator enabled this plug-in, a SquirrelMail user could use this\nflaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which\ncontains backported patches to correct these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2012-February/002597.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2012-February/002598.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 4 / 5\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL4\", reference:\"squirrelmail-1.4.8-18.0.1.el4\")) flag++;\n\nif (rpm_check(release:\"EL5\", reference:\"squirrelmail-1.4.8-5.0.1.el5_7.13\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T14:39:48", "description": "An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data. With this update, the SquirrelMail main frame can only be loaded into the top most browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2012-02-09T00:00:00", "type": "nessus", "title": "RHEL 4 / 5 : squirrelmail (RHSA-2012:0103)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:squirrelmail", "cpe:/o:redhat:enterprise_linux:4", "cpe:/o:redhat:enterprise_linux:5"], "id": "REDHAT-RHSA-2012-0103.NASL", "href": "https://www.tenable.com/plugins/nessus/57870", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2012:0103. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57870);\n script_version(\"1.22\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-1637\", \"CVE-2010-2813\", \"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_bugtraq_id(40291, 42399, 48648);\n script_xref(name:\"RHSA\", value:\"2012:0103\");\n\n script_name(english:\"RHEL 4 / 5 : squirrelmail (RHSA-2012:0103)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated squirrelmail package that fixes several security issues is\nnow available for Red Hat Enterprise Linux 4 and 5.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail\nperformed the sanitization of HTML style tag content. A remote\nattacker could use this flaw to send a specially crafted Multipurpose\nInternet Mail Extensions (MIME) message that, when opened by a victim,\nwould lead to arbitrary web script execution in the context of their\nSquirrelMail session. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail.\nA remote attacker could possibly use these flaws to execute arbitrary\nweb script in the context of a victim's SquirrelMail session.\n(CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled\nthe content of various HTML input fields. A remote attacker could use\nthis flaw to alter user preference values via a newline character\ncontained in the input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages\ndid not protect against Cross-Site Request Forgery (CSRF) attacks. If\na remote attacker could trick a user, who was logged into\nSquirrelMail, into visiting a specially crafted URL, the attacker\ncould empty the victim's trash folder or alter the ordering of the\ncolumns on the message index page. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing\na remote attacker to perform a clickjacking attack against logged in\nusers and possibly gain access to sensitive user data. With this\nupdate, the SquirrelMail main frame can only be loaded into the top\nmost browser frame. (CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in\nattempts. A user preference file was created when attempting to log in\nwith a password containing an 8-bit character, even if the username\nwas not valid. A remote attacker could use this flaw to eventually\nconsume all hard disk space on the target SquirrelMail server.\n(CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an\nadministrator enabled this plug-in, a SquirrelMail user could use this\nflaw to port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which\ncontains backported patches to correct these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squirrelmail.org/security/issue/2010-06-21\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squirrelmail.org/security/issue/2010-07-23\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squirrelmail.org/security/issue/2011-07-10\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squirrelmail.org/security/issue/2011-07-11\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squirrelmail.org/security/issue/2011-07-12\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2012:0103\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-1637\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-2023\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-2813\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-2753\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-2752\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4554\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4555\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x / 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2012:0103\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL4\", reference:\"squirrelmail-1.4.8-18.el4\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", reference:\"squirrelmail-1.4.8-5.el5_7.13\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n }\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:24:46", "description": "Various vulnerabilities have been found in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :\n\n - CVE-2010-4554 SquirrelMail did not prevent page rendering inside a third-party HTML frame, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted website.\n\n - CVE-2010-4555, CVE-2011-2752, CVE-2011-2753 Multiple small bugs in SquirrelMail allowed an attacker to inject malicious script into various pages or alter the contents of user preferences.\n\n - CVE-2011-2023 It was possible to inject arbitrary web script or HTML via a crafted STYLE element in an HTML part of an e-mail message.", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "nessus", "title": "Debian DSA-2291-1 : squirrelmail - various vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:squirrelmail", "cpe:/o:debian:debian_linux:5.0", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DSA-2291.NASL", "href": "https://www.tenable.com/plugins/nessus/55776", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2291. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(55776);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\", \"CVE-2011-2752\", \"CVE-2011-2753\");\n script_bugtraq_id(48648);\n script_xref(name:\"DSA\", value:\"2291\");\n\n script_name(english:\"Debian DSA-2291-1 : squirrelmail - various vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Various vulnerabilities have been found in SquirrelMail, a webmail\napplication. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities :\n\n - CVE-2010-4554\n SquirrelMail did not prevent page rendering inside a\n third-party HTML frame, which makes it easier for remote\n attackers to conduct clickjacking attacks via a crafted\n website.\n\n - CVE-2010-4555, CVE-2011-2752, CVE-2011-2753\n Multiple small bugs in SquirrelMail allowed an attacker\n to inject malicious script into various pages or alter\n the contents of user preferences.\n\n - CVE-2011-2023\n It was possible to inject arbitrary web script or HTML\n via a crafted STYLE element in an HTML part of an e-mail\n message.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2010-4554\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2010-4555\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-2752\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-2753\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2011-2023\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/squirrelmail\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2011/dsa-2291\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the squirrelmail packages.\n\nFor the oldstable distribution (lenny), these problems have been fixed\nin version 1.4.15-4+lenny5.\n\nFor the stable distribution (squeeze), these problems have been fixed\nin version 1.4.21-2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/08/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/08/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"squirrelmail\", reference:\"1.4.15-4+lenny5\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"squirrelmail\", reference:\"1.4.21-2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-04T14:41:13", "description": "fixes :\n\n - CVE-2011-2023 : Messages containing style tags with malicious script attributes were being displayed without being sanitized\n\n - CVE-2010-4555 : An attacker could use one of several small bugs in SquirrelMail to inject malicious script into various pages or alter the contents of user preferences\n\n - CVE-2010-4554 : SquirrelMail is vulnerable to clickjacking attacks wherein the entire application can be loaded in a frame that could overlay other elements on top of SquirrelMail\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-07-25T00:00:00", "type": "nessus", "title": "Fedora 14 : squirrelmail-1.4.22-2.fc14 (2011-9309)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:14"], "id": "FEDORA_2011-9309.NASL", "href": "https://www.tenable.com/plugins/nessus/55659", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-9309.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(55659);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\");\n script_bugtraq_id(48648);\n script_xref(name:\"FEDORA\", value:\"2011-9309\");\n\n script_name(english:\"Fedora 14 : squirrelmail-1.4.22-2.fc14 (2011-9309)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"fixes :\n\n - CVE-2011-2023 : Messages containing style tags with\n malicious script attributes were being displayed without\n being sanitized\n\n - CVE-2010-4555 : An attacker could use one of several\n small bugs in SquirrelMail to inject malicious script\n into various pages or alter the contents of user\n preferences\n\n - CVE-2010-4554 : SquirrelMail is vulnerable to\n clickjacking attacks wherein the entire application\n can be loaded in a frame that could overlay other\n elements on top of SquirrelMail\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=720693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=720694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=720695\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-July/062983.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9f51d715\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:14\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/07/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^14([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 14.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC14\", reference:\"squirrelmail-1.4.22-2.fc14\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:24:15", "description": "fixes :\n\n - CVE-2011-2023 : Messages containing style tags with malicious script attributes were being displayed without being sanitized\n\n - CVE-2010-4555 : An attacker could use one of several small bugs in SquirrelMail to inject malicious script into various pages or alter the contents of user preferences\n\n - CVE-2010-4554 : SquirrelMail is vulnerable to clickjacking attacks wherein the entire application can be loaded in a frame that could overlay other elements on top of SquirrelMail\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-07-25T00:00:00", "type": "nessus", "title": "Fedora 15 : squirrelmail-1.4.22-2.fc15 (2011-9311)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:15"], "id": "FEDORA_2011-9311.NASL", "href": "https://www.tenable.com/plugins/nessus/55660", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-9311.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(55660);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-4554\", \"CVE-2010-4555\", \"CVE-2011-2023\");\n script_bugtraq_id(48648);\n script_xref(name:\"FEDORA\", value:\"2011-9311\");\n\n script_name(english:\"Fedora 15 : squirrelmail-1.4.22-2.fc15 (2011-9311)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"fixes :\n\n - CVE-2011-2023 : Messages containing style tags with\n malicious script attributes were being displayed without\n being sanitized\n\n - CVE-2010-4555 : An attacker could use one of several\n small bugs in SquirrelMail to inject malicious script\n into various pages or alter the contents of user\n preferences\n\n - CVE-2010-4554 : SquirrelMail is vulnerable to\n clickjacking attacks wherein the entire application\n can be loaded in a frame that could overlay other\n elements on top of SquirrelMail\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=720693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=720694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=720695\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-July/062939.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?bb100f5f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:15\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/07/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^15([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 15.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC15\", reference:\"squirrelmail-1.4.22-2.fc15\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:28:30", "description": "- Tue Jun 22 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-3\n\n - fix CVE-2010-1637 : mail fetch plugin's port-scans via non-standard POP3 server ports\n\n - Mon Jun 7 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-2\n\n - add note to config file that https connections are forced by default\n\n - Mon Mar 8 2010 Michal Hlavinka <mhlavink at redhat.com> - 1.4.20-1\n\n - updated to 1.4.20\n\n - translations updated\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2010-07-01T00:00:00", "type": "nessus", "title": "Fedora 12 : squirrelmail-1.4.20-3.fc12 (2010-10244)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:12"], "id": "FEDORA_2010-10244.NASL", "href": "https://www.tenable.com/plugins/nessus/47216", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-10244.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47216);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1637\");\n script_xref(name:\"FEDORA\", value:\"2010-10244\");\n\n script_name(english:\"Fedora 12 : squirrelmail-1.4.20-3.fc12 (2010-10244)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Tue Jun 22 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-3\n\n - fix CVE-2010-1637 : mail fetch plugin's port-scans via\n non-standard POP3 server ports\n\n - Mon Jun 7 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-2\n\n - add note to config file that https connections are\n forced by default\n\n - Mon Mar 8 2010 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.20-1\n\n - updated to 1.4.20\n\n - translations updated\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=606459\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?40d6fe26\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:12\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^12([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 12.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC12\", reference:\"squirrelmail-1.4.20-3.fc12\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:33:08", "description": "- Tue Jun 22 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-3\n\n - fix CVE-2010-1637 : mail fetch plugin's port-scans via non-standard POP3 server ports\n\n - Mon Jun 7 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-2\n\n - add note to config file that https connections are forced by default\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2010-07-01T00:00:00", "type": "nessus", "title": "Fedora 13 : squirrelmail-1.4.20-3.fc13 (2010-10259)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:13"], "id": "FEDORA_2010-10259.NASL", "href": "https://www.tenable.com/plugins/nessus/47217", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-10259.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47217);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1637\");\n script_xref(name:\"FEDORA\", value:\"2010-10259\");\n\n script_name(english:\"Fedora 13 : squirrelmail-1.4.20-3.fc13 (2010-10259)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Tue Jun 22 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-3\n\n - fix CVE-2010-1637 : mail fetch plugin's port-scans via\n non-standard POP3 server ports\n\n - Mon Jun 7 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-2\n\n - add note to config file that https connections are\n forced by default\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=606459\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1ec5438e\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:13\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^13([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 13.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC13\", reference:\"squirrelmail-1.4.20-3.fc13\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:33:24", "description": "- Tue Jun 22 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-2\n\n - fix CVE-2010-1637 : mail fetch plugin's port-scans via non-standard POP3 server ports\n\n - Mon Mar 8 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-1\n\n - updated to 1.4.20\n\n - translations updated\n\n - Thu Sep 17 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.20-0.rc2.20100104\n\n - updated to 1.4.20RC2 20100104 snapshot\n\n - fix multi-word searching (#551626)\n\n - Thu Sep 17 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.20-0.rc2.20090917\n\n - updated to 1.4.20RC2 20090917 snapshot\n\n - fix searching in emails (#523016)\n\n - Wed Aug 19 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.20RC2-1\n\n - updated to 1.4.20RC2\n\n - Thu Aug 13 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.20RC1-1\n\n - updated to 1.4.20RC1\n\n - fixes #517312 - CSRF issues in all forms (SA34627)\n\n - Sun Jul 26 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.4.19-4\n\n - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n - Wed Jul 1 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.19-3\n\n - change default configuration to use only ssl connections\n\n - Tue Jun 30 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.19-2\n\n - use hunspell instead of ispell in squirrelspell plugin (#508631)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2010-07-01T00:00:00", "type": "nessus", "title": "Fedora 11 : squirrelmail-1.4.20-2.fc11 (2010-10264)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:11"], "id": "FEDORA_2010-10264.NASL", "href": "https://www.tenable.com/plugins/nessus/47218", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-10264.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(47218);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1637\");\n script_xref(name:\"FEDORA\", value:\"2010-10264\");\n\n script_name(english:\"Fedora 11 : squirrelmail-1.4.20-2.fc11 (2010-10264)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Tue Jun 22 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-2\n\n - fix CVE-2010-1637 : mail fetch plugin's port-scans via\n non-standard POP3 server ports\n\n - Mon Mar 8 2010 Michal Hlavinka <mhlavink at redhat.com>\n - 1.4.20-1\n\n - updated to 1.4.20\n\n - translations updated\n\n - Thu Sep 17 2009 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.20-0.rc2.20100104\n\n - updated to 1.4.20RC2 20100104 snapshot\n\n - fix multi-word searching (#551626)\n\n - Thu Sep 17 2009 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.20-0.rc2.20090917\n\n - updated to 1.4.20RC2 20090917 snapshot\n\n - fix searching in emails (#523016)\n\n - Wed Aug 19 2009 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.20RC2-1\n\n - updated to 1.4.20RC2\n\n - Thu Aug 13 2009 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.20RC1-1\n\n - updated to 1.4.20RC1\n\n - fixes #517312 - CSRF issues in all forms (SA34627)\n\n - Sun Jul 26 2009 Fedora Release Engineering <rel-eng at\n lists.fedoraproject.org> - 1.4.19-4\n\n - Rebuilt for\n https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n - Wed Jul 1 2009 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.19-3\n\n - change default configuration to use only ssl\n connections\n\n - Tue Jun 30 2009 Michal Hlavinka <mhlavink at\n redhat.com> - 1.4.19-2\n\n - use hunspell instead of ispell in squirrelspell plugin\n (#508631)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=606459\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0ec7bbea\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^11([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 11.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC11\", reference:\"squirrelmail-1.4.20-2.fc11\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:35:48", "description": "Fixes literal processing of 8-bit usernames/passwords during login (CVE-2010-2813): * http://squirrelmail.org/security/issue/2010-07-23\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2010-08-12T00:00:00", "type": "nessus", "title": "Fedora 13 : squirrelmail-1.4.21-1.fc13 (2010-11422)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:13"], "id": "FEDORA_2010-11422.NASL", "href": "https://www.tenable.com/plugins/nessus/48305", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-11422.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(48305);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-2813\");\n script_xref(name:\"FEDORA\", value:\"2010-11422\");\n\n script_name(english:\"Fedora 13 : squirrelmail-1.4.21-1.fc13 (2010-11422)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fixes literal processing of 8-bit usernames/passwords during login\n(CVE-2010-2813): * http://squirrelmail.org/security/issue/2010-07-23\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://squirrelmail.org/security/issue/2010-07-23\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=618096\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4fdd4c1d\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:13\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/07/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/08/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^13([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 13.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC13\", reference:\"squirrelmail-1.4.21-1.fc13\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-04T14:38:09", "description": "Fixes literal processing of 8-bit usernames/passwords during login (CVE-2010-2813): * http://squirrelmail.org/security/issue/2010-07-23\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2010-08-12T00:00:00", "type": "nessus", "title": "Fedora 12 : squirrelmail-1.4.21-1.fc12 (2010-11410)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:squirrelmail", "cpe:/o:fedoraproject:fedora:12"], "id": "FEDORA_2010-11410.NASL", "href": "https://www.tenable.com/plugins/nessus/48304", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-11410.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(48304);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-2813\");\n script_xref(name:\"FEDORA\", value:\"2010-11410\");\n\n script_name(english:\"Fedora 12 : squirrelmail-1.4.21-1.fc12 (2010-11410)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fixes literal processing of 8-bit usernames/passwords during login\n(CVE-2010-2813): * http://squirrelmail.org/security/issue/2010-07-23\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://squirrelmail.org/security/issue/2010-07-23\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=618096\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?14f7e3ca\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:12\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/07/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/08/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^12([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 12.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC12\", reference:\"squirrelmail-1.4.21-1.fc12\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:35:52", "description": "SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery (CSRF) attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other actions, by tricking the victim into following a link controlled by the offender.\n\nIn addition, a denial-of-service was fixed, which could be triggered when a password containing 8-bit characters was used to log in (CVE-2010-2813 ).", "cvss3": {}, "published": "2010-08-17T00:00:00", "type": "nessus", "title": "Debian DSA-2091-1 : squirrelmail - No user-specific token implemented", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2964", "CVE-2010-2813"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:squirrelmail", "cpe:/o:debian:debian_linux:5.0"], "id": "DEBIAN_DSA-2091.NASL", "href": "https://www.tenable.com/plugins/nessus/48344", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2091. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(48344);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2009-2964\", \"CVE-2010-2813\");\n script_bugtraq_id(36196, 42399);\n script_xref(name:\"DSA\", value:\"2091\");\n\n script_name(english:\"Debian DSA-2091-1 : squirrelmail - No user-specific token implemented\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"SquirrelMail, a webmail application, does not employ a user-specific\ntoken for webforms. This allows a remote attacker to perform a Cross\nSite Request Forgery (CSRF) attack. The attacker may hijack the\nauthentication of unspecified victims and send messages or change user\npreferences among other actions, by tricking the victim into following\na link controlled by the offender.\n\nIn addition, a denial-of-service was fixed, which could be triggered\nwhen a password containing 8-bit characters was used to log in\n(CVE-2010-2813 ).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2010-2813\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2010/dsa-2091\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the squirrelmail packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny3.1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(352);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/08/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"squirrelmail\", reference:\"1.4.15-4+lenny3.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:08:45", "description": "An updated squirrelmail package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum text stated, correct the CVE-2010-2813 issue, a flaw in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n* Prior to this update, SquirrelMail could not decode multi-line subjects properly. Consequently, the decode header internationalization option did not properly handle new lines or tabs at the beginning of the lines. This bug has been fixed and SquirrelMail now works correctly in the described scenario.\n(BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows operating system were not displayed properly when accessed with SquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has been fixed and the attachments are now displayed correctly in such a case. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger than 2^31 bytes were unreadable when using the squirrelmail package.\nWith this patch the squirrelmail package is able to read all messages regardless of the UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set to requested variables. Consequently, SquirrelMail could not display any e-mails. The underlying source code has been modified and now the squirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the i18n.php file, the squirrelmail package could not use the GB 2312 character set. The i18n.php file has been fixed and the GB 2312 character set works correctly in the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled constant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error messages. The name of the constant has been corrected to PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in this scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from the SquirrelMail web interface was blocked. This update adds a note to the SquirrelMail documentation that describes how to set the SELinux options to allow sending e-mails from the SquirrelMail web interface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC 2822 specification about line length limits. Consequently, attachments with lines longer than 998 characters could not be forwarded using SquirrelMail. This patch modifies the underlying source code and now SquirrelMail complies with the RFC 2822 specification as expected.\n(BZ#745469)\n\n* Prior to this update, the squirrelmail package required the php-common script instead of the mod_php script during installation or upgrade of the package, which led to a dependency error. As a result, attempting to install or upgrade the squirrelmail package failed on systems using the php53 packages. With this update, the dependencies of the squirrelmail package were changed and the installation or upgrade now works correctly in the described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2013-01-17T00:00:00", "type": "nessus", "title": "CentOS 5 : squirrelmail (CESA-2013:0126)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:squirrelmail", "cpe:/o:centos:centos:5"], "id": "CENTOS_RHSA-2013-0126.NASL", "href": "https://www.tenable.com/plugins/nessus/63571", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2013:0126 and \n# CentOS Errata and Security Advisory 2013:0126 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(63571);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2012-2124\");\n script_bugtraq_id(57201);\n script_xref(name:\"RHSA\", value:\"2013:0126\");\n\n script_name(english:\"CentOS 5 : squirrelmail (CESA-2013:0126)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated squirrelmail package that fixes one security issue and\nseveral bugs is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the\nerratum text stated, correct the CVE-2010-2813 issue, a flaw in the\nway SquirrelMail handled failed log in attempts. A user preference\nfile was created when attempting to log in with a password containing\nan 8-bit character, even if the username was not valid. A remote\nattacker could use this flaw to eventually consume all hard disk space\non the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n* Prior to this update, SquirrelMail could not decode multi-line\nsubjects properly. Consequently, the decode header\ninternationalization option did not properly handle new lines or tabs\nat the beginning of the lines. This bug has been fixed and\nSquirrelMail now works correctly in the described scenario.\n(BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows\noperating system were not displayed properly when accessed with\nSquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has\nbeen fixed and the attachments are now displayed correctly in such a\ncase. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger\nthan 2^31 bytes were unreadable when using the squirrelmail package.\nWith this patch the squirrelmail package is able to read all messages\nregardless of the UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set\nto requested variables. Consequently, SquirrelMail could not display\nany e-mails. The underlying source code has been modified and now the\nsquirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the\ni18n.php file, the squirrelmail package could not use the GB 2312\ncharacter set. The i18n.php file has been fixed and the GB 2312\ncharacter set works correctly in the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled\nconstant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to\nproduce error messages. The name of the constant has been corrected to\nPREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error\nmessages in this scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails\nfrom the SquirrelMail web interface was blocked. This update adds a\nnote to the SquirrelMail documentation that describes how to set the\nSELinux options to allow sending e-mails from the SquirrelMail web\ninterface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC\n2822 specification about line length limits. Consequently, attachments\nwith lines longer than 998 characters could not be forwarded using\nSquirrelMail. This patch modifies the underlying source code and now\nSquirrelMail complies with the RFC 2822 specification as expected.\n(BZ#745469)\n\n* Prior to this update, the squirrelmail package required the\nphp-common script instead of the mod_php script during installation or\nupgrade of the package, which led to a dependency error. As a result,\nattempting to install or upgrade the squirrelmail package failed on\nsystems using the php53 packages. With this update, the dependencies\nof the squirrelmail package were changed and the installation or\nupgrade now works correctly in the described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated\npackage, which contains backported patches to correct these issues.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2013-January/019177.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?bd3d003b\"\n );\n # https://lists.centos.org/pipermail/centos-cr-announce/2013-January/000439.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9f35d3e7\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2012-2124\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/01/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/01/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/01/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 5.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-5\", reference:\"squirrelmail-1.4.8-21.el5.centos\")) flag++;\n\n\nif (flag)\n{\n cr_plugin_caveat = '\\n' +\n 'NOTE: The security advisory associated with this vulnerability has a\\n' +\n 'fixed package version that may only be available in the continuous\\n' +\n 'release (CR) repository for CentOS, until it is present in the next\\n' +\n 'point release of CentOS.\\n\\n' +\n\n 'If an equal or higher package level does not exist in the baseline\\n' +\n 'repository for your major version of CentOS, then updates from the CR\\n' +\n 'repository will need to be applied in order to address the\\n' +\n 'vulnerability.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + cr_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:08:57", "description": "The SquirrelMail security update SLSA-2012:0103 did not, unlike the erratum text stated, correct the CVE-2010-2813 issue, a flaw in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n - Prior to this update, SquirrelMail could not decode multi-line subjects properly. Consequently, the decode header internationalization option did not properly handle new lines or tabs at the beginning of the lines.\n This bug has been fixed and SquirrelMail now works correctly in the described scenario.\n\n - Due to a bug, attachments written in HTML code on the Windows operating system were not displayed properly when accessed with SquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has been fixed and the attachments are now displayed correctly in such a case.\n\n - Previously, e-mail messages with a Unique Identifier (UID) larger than 2^31 bytes were unreadable when using the squirrelmail package. With this patch the squirrelmail package is able to read all messages regardless of the UIDs size.\n\n - Due to a bug, a PHP script did not assign the proper character set to requested variables. Consequently, SquirrelMail could not display any e-mails. The underlying source code has been modified and now the squirrelmail package assigns the correct character set.\n\n - Due to the incorrect internationalization option located at the i18n.php file, the squirrelmail package could not use the GB 2312 character set. The i18n.php file has been fixed and the GB 2312 character set works correctly in the described scenario.\n\n - Previously, the preg_split() function contained a misspelled constant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error messages. The name of the constant has been corrected to PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in this scenario.\n\n - Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from the SquirrelMail web interface was blocked. This update adds a note to the SquirrelMail documentation that describes how to set the SELinux options to allow sending e-mails from the SquirrelMail web interface.\n\n - Previously, the squirrelmail package did not comply with the RFC 2822 specification about line length limits.\n Consequently, attachments with lines longer than 998 characters could not be forwarded using SquirrelMail.\n This patch modifies the underlying source code and now SquirrelMail complies with the RFC 2822 specification as expected.\n\n - Prior to this update, the squirrelmail package required the php-common script instead of the mod_php script during installation or upgrade of the package, which led to a dependency error. As a result, attempting to install or upgrade the squirrelmail package failed on systems using the php53 packages. With this update, the dependencies of the squirrelmail package were changed and the installation or upgrade now works correctly in the described scenario.", "cvss3": {}, "published": "2013-01-17T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : squirrelmail on SL5.x (noarch) (20130108)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:squirrelmail", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20130108_SQUIRRELMAIL_ON_SL5_X.NASL", "href": "https://www.tenable.com/plugins/nessus/63604", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(63604);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-2813\", \"CVE-2012-2124\");\n\n script_name(english:\"Scientific Linux Security Update : squirrelmail on SL5.x (noarch) (20130108)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Scientific Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SquirrelMail security update SLSA-2012:0103 did not, unlike the\nerratum text stated, correct the CVE-2010-2813 issue, a flaw in the\nway SquirrelMail handled failed log in attempts. A user preference\nfile was created when attempting to log in with a password containing\nan 8-bit character, even if the username was not valid. A remote\nattacker could use this flaw to eventually consume all hard disk space\non the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n - Prior to this update, SquirrelMail could not decode\n multi-line subjects properly. Consequently, the decode\n header internationalization option did not properly\n handle new lines or tabs at the beginning of the lines.\n This bug has been fixed and SquirrelMail now works\n correctly in the described scenario.\n\n - Due to a bug, attachments written in HTML code on the\n Windows operating system were not displayed properly\n when accessed with SquirrelMail; the '!=null' string was\n trimmed to '!ull'. This bug has been fixed and the\n attachments are now displayed correctly in such a case.\n\n - Previously, e-mail messages with a Unique Identifier\n (UID) larger than 2^31 bytes were unreadable when using\n the squirrelmail package. With this patch the\n squirrelmail package is able to read all messages\n regardless of the UIDs size.\n\n - Due to a bug, a PHP script did not assign the proper\n character set to requested variables. Consequently,\n SquirrelMail could not display any e-mails. The\n underlying source code has been modified and now the\n squirrelmail package assigns the correct character set.\n\n - Due to the incorrect internationalization option located\n at the i18n.php file, the squirrelmail package could not\n use the GB 2312 character set. The i18n.php file has\n been fixed and the GB 2312 character set works correctly\n in the described scenario.\n\n - Previously, the preg_split() function contained a\n misspelled constant, PREG_SPLIT_NI_EMPTY, which could\n cause SquirrelMail to produce error messages. The name\n of the constant has been corrected to\n PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces\n error messages in this scenario.\n\n - Due to Security-Enhanced Linux (SELinux) settings,\n sending e-mails from the SquirrelMail web interface was\n blocked. This update adds a note to the SquirrelMail\n documentation that describes how to set the SELinux\n options to allow sending e-mails from the SquirrelMail\n web interface.\n\n - Previously, the squirrelmail package did not comply with\n the RFC 2822 specification about line length limits.\n Consequently, attachments with lines longer than 998\n characters could not be forwarded using SquirrelMail.\n This patch modifies the underlying source code and now\n SquirrelMail complies with the RFC 2822 specification as\n expected.\n\n - Prior to this update, the squirrelmail package required\n the php-common script instead of the mod_php script\n during installation or upgrade of the package, which led\n to a dependency error. As a result, attempting to\n install or upgrade the squirrelmail package failed on\n systems using the php53 packages. With this update, the\n dependencies of the squirrelmail package were changed\n and the installation or upgrade now works correctly in\n the described scenario.\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1301&L=scientific-linux-errata&T=0&P=577\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?881ef834\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/08/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/01/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/01/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 5.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL5\", reference:\"squirrelmail-1.4.8-21.el5\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:09:58", "description": "An updated squirrelmail package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum text stated, correct the CVE-2010-2813 issue, a flaw in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n* Prior to this update, SquirrelMail could not decode multi-line subjects properly. Consequently, the decode header internationalization option did not properly handle new lines or tabs at the beginning of the lines. This bug has been fixed and SquirrelMail now works correctly in the described scenario.\n(BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows operating system were not displayed properly when accessed with SquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has been fixed and the attachments are now displayed correctly in such a case. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger than 2^31 bytes were unreadable when using the squirrelmail package.\nWith this patch the squirrelmail package is able to read all messages regardless of the UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set to requested variables. Consequently, SquirrelMail could not display any e-mails. The underlying source code has been modified and now the squirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the i18n.php file, the squirrelmail package could not use the GB 2312 character set. The i18n.php file has been fixed and the GB 2312 character set works correctly in the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled constant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error messages. The name of the constant has been corrected to PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in this scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from the SquirrelMail web interface was blocked. This update adds a note to the SquirrelMail documentation that describes how to set the SELinux options to allow sending e-mails from the SquirrelMail web interface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC 2822 specification about line length limits. Consequently, attachments with lines longer than 998 characters could not be forwarded using SquirrelMail. This patch modifies the underlying source code and now SquirrelMail complies with the RFC 2822 specification as expected.\n(BZ#745469)\n\n* Prior to this update, the squirrelmail package required the php-common script instead of the mod_php script during installation or upgrade of the package, which led to a dependency error. As a result, attempting to install or upgrade the squirrelmail package failed on systems using the php53 packages. With this update, the dependencies of the squirrelmail package were changed and the installation or upgrade now works correctly in the described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2013-01-08T00:00:00", "type": "nessus", "title": "RHEL 5 : squirrelmail (RHSA-2013:0126)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:squirrelmail", "cpe:/o:redhat:enterprise_linux:5"], "id": "REDHAT-RHSA-2013-0126.NASL", "href": "https://www.tenable.com/plugins/nessus/63409", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2013:0126. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(63409);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2012-2124\");\n script_xref(name:\"RHSA\", value:\"2013:0126\");\n\n script_name(english:\"RHEL 5 : squirrelmail (RHSA-2013:0126)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated squirrelmail package that fixes one security issue and\nseveral bugs is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the\nerratum text stated, correct the CVE-2010-2813 issue, a flaw in the\nway SquirrelMail handled failed log in attempts. A user preference\nfile was created when attempting to log in with a password containing\nan 8-bit character, even if the username was not valid. A remote\nattacker could use this flaw to eventually consume all hard disk space\non the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n* Prior to this update, SquirrelMail could not decode multi-line\nsubjects properly. Consequently, the decode header\ninternationalization option did not properly handle new lines or tabs\nat the beginning of the lines. This bug has been fixed and\nSquirrelMail now works correctly in the described scenario.\n(BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows\noperating system were not displayed properly when accessed with\nSquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has\nbeen fixed and the attachments are now displayed correctly in such a\ncase. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger\nthan 2^31 bytes were unreadable when using the squirrelmail package.\nWith this patch the squirrelmail package is able to read all messages\nregardless of the UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set\nto requested variables. Consequently, SquirrelMail could not display\nany e-mails. The underlying source code has been modified and now the\nsquirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the\ni18n.php file, the squirrelmail package could not use the GB 2312\ncharacter set. The i18n.php file has been fixed and the GB 2312\ncharacter set works correctly in the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled\nconstant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to\nproduce error messages. The name of the constant has been corrected to\nPREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error\nmessages in this scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails\nfrom the SquirrelMail web interface was blocked. This update adds a\nnote to the SquirrelMail documentation that describes how to set the\nSELinux options to allow sending e-mails from the SquirrelMail web\ninterface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC\n2822 specification about line length limits. Consequently, attachments\nwith lines longer than 998 characters could not be forwarded using\nSquirrelMail. This patch modifies the underlying source code and now\nSquirrelMail complies with the RFC 2822 specification as expected.\n(BZ#745469)\n\n* Prior to this update, the squirrelmail package required the\nphp-common script instead of the mod_php script during installation or\nupgrade of the package, which led to a dependency error. As a result,\nattempting to install or upgrade the squirrelmail package failed on\nsystems using the php53 packages. With this update, the dependencies\nof the squirrelmail package were changed and the installation or\nupgrade now works correctly in the described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated\npackage, which contains backported patches to correct these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://rhn.redhat.com/errata/RHSA-2012-0103.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2013:0126\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2012-2124\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/01/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2013:0126\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL5\", reference:\"squirrelmail-1.4.8-21.el5\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n }\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T15:20:07", "description": "From Red Hat Security Advisory 2013:0126 :\n\nAn updated squirrelmail package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum text stated, correct the CVE-2010-2813 issue, a flaw in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n* Prior to this update, SquirrelMail could not decode multi-line subjects properly. Consequently, the decode header internationalization option did not properly handle new lines or tabs at the beginning of the lines. This bug has been fixed and SquirrelMail now works correctly in the described scenario.\n(BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows operating system were not displayed properly when accessed with SquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has been fixed and the attachments are now displayed correctly in such a case. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger than 2^31 bytes were unreadable when using the squirrelmail package.\nWith this patch the squirrelmail package is able to read all messages regardless of the UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set to requested variables. Consequently, SquirrelMail could not display any e-mails. The underlying source code has been modified and now the squirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the i18n.php file, the squirrelmail package could not use the GB 2312 character set. The i18n.php file has been fixed and the GB 2312 character set works correctly in the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled constant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error messages. The name of the constant has been corrected to PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in this scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from the SquirrelMail web interface was blocked. This update adds a note to the SquirrelMail documentation that describes how to set the SELinux options to allow sending e-mails from the SquirrelMail web interface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC 2822 specification about line length limits. Consequently, attachments with lines longer than 998 characters could not be forwarded using SquirrelMail. This patch modifies the underlying source code and now SquirrelMail complies with the RFC 2822 specification as expected.\n(BZ#745469)\n\n* Prior to this update, the squirrelmail package required the php-common script instead of the mod_php script during installation or upgrade of the package, which led to a dependency error. As a result, attempting to install or upgrade the squirrelmail package failed on systems using the php53 packages. With this update, the dependencies of the squirrelmail package were changed and the installation or upgrade now works correctly in the described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated package, which contains backported patches to correct these issues.", "cvss3": {}, "published": "2013-07-12T00:00:00", "type": "nessus", "title": "Oracle Linux 5 : squirrelmail (ELSA-2013-0126)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:squirrelmail", "cpe:/o:oracle:linux:5"], "id": "ORACLELINUX_ELSA-2013-0126.NASL", "href": "https://www.tenable.com/plugins/nessus/68697", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2013:0126 and \n# Oracle Linux Security Advisory ELSA-2013-0126 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(68697);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2012-2124\");\n script_bugtraq_id(42399);\n script_xref(name:\"RHSA\", value:\"2013:0126\");\n\n script_name(english:\"Oracle Linux 5 : squirrelmail (ELSA-2013-0126)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2013:0126 :\n\nAn updated squirrelmail package that fixes one security issue and\nseveral bugs is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available from the\nCVE link in the References section.\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the\nerratum text stated, correct the CVE-2010-2813 issue, a flaw in the\nway SquirrelMail handled failed log in attempts. A user preference\nfile was created when attempting to log in with a password containing\nan 8-bit character, even if the username was not valid. A remote\nattacker could use this flaw to eventually consume all hard disk space\non the target SquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs :\n\n* Prior to this update, SquirrelMail could not decode multi-line\nsubjects properly. Consequently, the decode header\ninternationalization option did not properly handle new lines or tabs\nat the beginning of the lines. This bug has been fixed and\nSquirrelMail now works correctly in the described scenario.\n(BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows\noperating system were not displayed properly when accessed with\nSquirrelMail; the '!=null' string was trimmed to '!ull'. This bug has\nbeen fixed and the attachments are now displayed correctly in such a\ncase. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger\nthan 2^31 bytes were unreadable when using the squirrelmail package.\nWith this patch the squirrelmail package is able to read all messages\nregardless of the UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set\nto requested variables. Consequently, SquirrelMail could not display\nany e-mails. The underlying source code has been modified and now the\nsquirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the\ni18n.php file, the squirrelmail package could not use the GB 2312\ncharacter set. The i18n.php file has been fixed and the GB 2312\ncharacter set works correctly in the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled\nconstant, PREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to\nproduce error messages. The name of the constant has been corrected to\nPREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error\nmessages in this scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails\nfrom the SquirrelMail web interface was blocked. This update adds a\nnote to the SquirrelMail documentation that describes how to set the\nSELinux options to allow sending e-mails from the SquirrelMail web\ninterface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC\n2822 specification about line length limits. Consequently, attachments\nwith lines longer than 998 characters could not be forwarded using\nSquirrelMail. This patch modifies the underlying source code and now\nSquirrelMail complies with the RFC 2822 specification as expected.\n(BZ#745469)\n\n* Prior to this update, the squirrelmail package required the\nphp-common script instead of the mod_php script during installation or\nupgrade of the package, which led to a dependency error. As a result,\nattempting to install or upgrade the squirrelmail package failed on\nsystems using the php53 packages. With this update, the dependencies\nof the squirrelmail package were changed and the installation or\nupgrade now works correctly in the described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated\npackage, which contains backported patches to correct these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2013-January/003206.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squirrelmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:squirrelmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/01/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/01/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 5\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL5\", reference:\"squirrelmail-1.4.8-21.0.2.el5\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squirrelmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-05T14:39:15", "description": "The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-001 applied. This update contains multiple security-related fixes for the following components :\n\n - Apache\n - ATS\n - ColorSync\n - CoreAudio\n - CoreMedia\n - CoreText\n - curl\n - Data Security\n - dovecot\n - filecmds\n - libresolv\n - libsecurity\n - OpenGL\n - PHP\n - QuickTime\n - SquirrelMail\n - Subversion\n - Tomcat\n - X11", "cvss3": {}, "published": "2012-02-02T00:00:00", "type": "nessus", "title": "Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-0200", "CVE-2011-1148", "CVE-2011-1657", "CVE-2011-1752", "CVE-2011-1783", "CVE-2011-1921", "CVE-2011-1938", "CVE-2011-2023", "CVE-2011-2192", "CVE-2011-2202", "CVE-2011-2204", "CVE-2011-2483", "CVE-2011-2895", "CVE-2011-3182", "CVE-2011-3189", "CVE-2011-3248", "CVE-2011-3249", "CVE-2011-3250", "CVE-2011-3252", "CVE-2011-3267", "CVE-2011-3268", "CVE-2011-3348", "CVE-2011-3389", "CVE-2011-3422", "CVE-2011-3446", "CVE-2011-3448", "CVE-2011-3449", "CVE-2011-3453", "CVE-2011-3457", "CVE-2011-3458", "CVE-2011-3459", "CVE-2011-3460"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:apple:mac_os_x"], "id": "MACOSX_SECUPD2012-001.NASL", "href": "https://www.tenable.com/plugins/nessus/57798", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57798);\n script_version(\"1.26\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2010-1637\",\n \"CVE-2010-2813\",\n \"CVE-2010-4554\",\n \"CVE-2010-4555\",\n \"CVE-2011-0200\",\n \"CVE-2011-1148\",\n \"CVE-2011-1657\",\n \"CVE-2011-1752\",\n \"CVE-2011-1783\",\n \"CVE-2011-1921\",\n \"CVE-2011-1938\",\n \"CVE-2011-2023\",\n \"CVE-2011-2192\",\n \"CVE-2011-2202\",\n \"CVE-2011-2204\",\n \"CVE-2011-2483\",\n \"CVE-2011-2895\",\n \"CVE-2011-3182\",\n \"CVE-2011-3189\",\n \"CVE-2011-3248\",\n \"CVE-2011-3249\",\n \"CVE-2011-3250\",\n \"CVE-2011-3252\",\n \"CVE-2011-3267\",\n \"CVE-2011-3268\",\n \"CVE-2011-3348\",\n \"CVE-2011-3389\",\n \"CVE-2011-3422\",\n \"CVE-2011-3446\",\n \"CVE-2011-3448\",\n \"CVE-2011-3449\",\n \"CVE-2011-3453\",\n \"CVE-2011-3457\",\n \"CVE-2011-3458\",\n \"CVE-2011-3459\",\n \"CVE-2011-3460\"\n );\n script_bugtraq_id(\n 40291,\n 42399,\n 46843,\n 47950,\n 48091,\n 48259,\n 48416,\n 48434,\n 48456,\n 48648,\n 49124,\n 49241,\n 49249,\n 49252,\n 49376,\n 49429,\n 49616,\n 49778,\n 50065,\n 50400,\n 50401,\n 50404,\n 51807,\n 51808,\n 51809,\n 51811,\n 51812,\n 51814,\n 51817,\n 51832\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2012-02-03-1\");\n script_xref(name:\"CERT\", value:\"403593\");\n script_xref(name:\"CERT\", value:\"410281\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2019-0547\");\n\n script_name(english:\"Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a Mac OS X update that fixes multiple\nsecurity vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X 10.6 that does not\nhave Security Update 2012-001 applied. This update contains multiple\nsecurity-related fixes for the following components :\n\n - Apache\n - ATS\n - ColorSync\n - CoreAudio\n - CoreMedia\n - CoreText\n - curl\n - Data Security\n - dovecot\n - filecmds\n - libresolv\n - libsecurity\n - OpenGL\n - PHP\n - QuickTime\n - SquirrelMail\n - Subversion\n - Tomcat\n - X11\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-12-058/\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-12-103/\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-12-130/\");\n script_set_attribute(attribute:\"see_also\", value:\"http://seclists.org/fulldisclosure/2012/Aug/59\");\n script_set_attribute(attribute:\"see_also\", value:\"http://support.apple.com/kb/HT5130\");\n script_set_attribute(attribute:\"see_also\", value:\"http://lists.apple.com/archives/security-announce/2012/Feb/msg00001.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://lists.apple.com/archives/security-announce/2012/Feb/msg00002.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.imperialviolet.org/2011/09/23/chromeandbeast.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.openssl.org/~bodo/tls-cbc.txt\");\n script_set_attribute(attribute:\"solution\", value:\n\"Install Security Update 2012-001 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/06/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/02/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2012-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/MacOSX/Version\", \"Host/MacOSX/packages/boms\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os) audit(AUDIT_OS_NOT, \"Mac OS X\");\nif (!ereg(pattern:\"Mac OS X 10\\.6([^0-9]|$)\", string:os)) audit(AUDIT_OS_NOT, \"Mac OS X 10.6\");\n\npackages = get_kb_item_or_exit(\"Host/MacOSX/packages/boms\", exit_code:1);\nif (\n egrep(pattern:\"^com\\.apple\\.pkg\\.update\\.security\\.(2012\\.00[1-9]|201[3-9]\\.[0-9]+)(\\.snowleopard[0-9.]*)?\\.bom\", string:packages) ||\n egrep(pattern:\"^com\\.apple\\.pkg\\.update\\.security\\.2012\\.001(\\.snowleopard)?\\.1\\.1\\.bom\", string:packages)\n) exit(0, \"The host has Security Update 2012-001 or later installed and therefore is not affected.\");\nelse\n{\n if (report_verbosity > 0)\n {\n security_boms = egrep(pattern:\"^com\\.apple\\.pkg\\.update\\.security\", string:packages);\n\n report = '\\n Installed security updates : ';\n if (security_boms) report += str_replace(find:'\\n', replace:'\\n ', string:security_boms);\n else report += 'n/a';\n report += '\\n';\n\n security_hole(port:0, extra:report);\n }\n else security_hole(0);\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:36:05", "description": "[1.4.8-5.0.1.el5_7.13]\n- Remove Redhat splash screen images\n[1.4.8-5.13]\n- fix typo in CVE-20210-4555 patch\n[1.4.8-5.12]\n- patch for CVE-2010-2813 was not complete\n[1.4.8-5.11]\n- fix: CVE-2010-1637 : Port-scans via non-standard POP3 server ports in \n Mail Fetch plugin\n- fix: CVE-2010-2813 : DoS (disk space consumption) by random IMAP login \n attempts with 8-bit characters in the password\n- fix: CVE-2010-4554 : Prone to clickjacking attacks\n- fix: CVE-2010-4555 : Multiple XSS flaws\n[tag handling]\n- fix: CVE-2011-2752 : CRLF injection vulnerability\n- fix: CVE-2011-2753 : CSRF in the empty trash feature and in Index Order page", "cvss3": {}, "published": "2012-02-08T00:00:00", "type": "oraclelinux", "title": "squirrelmail security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2010-2813", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555", "CVE-2010-1637"], "modified": "2012-02-08T00:00:00", "id": "ELSA-2012-0103", "href": "http://linux.oracle.com/errata/ELSA-2012-0103.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:54", "description": "[1.4.8-21.0.2.el5]\r\n- remove Redhat splash screen images from source\r\n \n[1.4.8-21.0.1.el5]\r\n- remove Redhat splash screen images\r\n- add README instead of README.RedHat\r\n \n[1.4.8-21]\r\n- change charset for zh_CN and zh_TW to utf-8 (#508686)\r\n \n[1.4.8-20]\r\n- fix header encoding issue (#241861)\r\n- fix code producing warnings in the log (#475188)\r\n \n[1.4.8-19]\r\n- patch for CVE-2010-2813 modified wrong file (#808598)\r\n- correct requirement is mod_php not php (#789353)\r\n- comply with RFC2822 line length limits (#745469)\r\n- document that SELinux boolean httpd_can_sendmail needs to be\r\n turned on (#745380)\r\n- add support for big UIDs on 32bit machines (#450780)\r\n- do not corrupt html attachments (#359791)", "cvss3": {}, "published": "2013-01-11T00:00:00", "type": "oraclelinux", "title": "squirrelmail security and bug fix update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2012-2124", "CVE-2010-2813"], "modified": "2013-01-11T00:00:00", "id": "ELSA-2013-0126", "href": "http://linux.oracle.com/errata/ELSA-2013-0126.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "centos": [{"lastseen": "2023-12-05T21:06:17", "description": "**CentOS Errata and Security Advisory** CESA-2012:0103\n\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nA cross-site scripting (XSS) flaw was found in the way SquirrelMail\nperformed the sanitization of HTML style tag content. A remote attacker\ncould use this flaw to send a specially-crafted Multipurpose Internet Mail\nExtensions (MIME) message that, when opened by a victim, would lead to\narbitrary web script execution in the context of their SquirrelMail\nsession. (CVE-2011-2023)\n\nMultiple cross-site scripting (XSS) flaws were found in SquirrelMail. A\nremote attacker could possibly use these flaws to execute arbitrary web\nscript in the context of a victim's SquirrelMail session. (CVE-2010-4555)\n\nAn input sanitization flaw was found in the way SquirrelMail handled the\ncontent of various HTML input fields. A remote attacker could use this\nflaw to alter user preference values via a newline character contained in\nthe input for these fields. (CVE-2011-2752)\n\nIt was found that the SquirrelMail Empty Trash and Index Order pages did\nnot protect against Cross-Site Request Forgery (CSRF) attacks. If a remote\nattacker could trick a user, who was logged into SquirrelMail, into\nvisiting a specially-crafted URL, the attacker could empty the victim's\ntrash folder or alter the ordering of the columns on the message index\npage. (CVE-2011-2753)\n\nSquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a\nremote attacker to perform a clickjacking attack against logged in users\nand possibly gain access to sensitive user data. With this update, the\nSquirrelMail main frame can only be loaded into the top most browser frame.\n(CVE-2010-4554)\n\nA flaw was found in the way SquirrelMail handled failed log in attempts. A\nuser preference file was created when attempting to log in with a password\ncontaining an 8-bit character, even if the username was not valid. A\nremote attacker could use this flaw to eventually consume all hard disk\nspace on the target SquirrelMail server. (CVE-2010-2813)\n\nA flaw was found in the SquirrelMail Mail Fetch plug-in. If an\nadministrator enabled this plug-in, a SquirrelMail user could use this flaw\nto port scan the local network the server was on. (CVE-2010-1637)\n\nUsers of SquirrelMail should upgrade to this updated package, which\ncontains backported patches to correct these issues.\n\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2012-February/080584.html\nhttps://lists.centos.org/pipermail/centos-announce/2012-February/080585.html\n\n**Affected packages:**\nsquirrelmail\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2012:0103", "cvss3": {}, "published": "2012-02-08T20:29:14", "type": "centos", "title": "squirrelmail security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813", "CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2012-02-08T20:33:10", "id": "CESA-2012:0103", "href": "https://lists.centos.org/pipermail/centos-announce/2012-February/080584.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-05T21:05:29", "description": "**CentOS Errata and Security Advisory** CESA-2013:0126\n\n\nSquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum\ntext stated, correct the CVE-2010-2813 issue, a flaw in the way\nSquirrelMail handled failed log in attempts. A user preference file was\ncreated when attempting to log in with a password containing an 8-bit\ncharacter, even if the username was not valid. A remote attacker could use\nthis flaw to eventually consume all hard disk space on the target\nSquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs:\n\n* Prior to this update, SquirrelMail could not decode multi-line subjects\nproperly. Consequently, the decode header internationalization option did\nnot properly handle new lines or tabs at the beginning of the lines. This\nbug has been fixed and SquirrelMail now works correctly in the described\nscenario. (BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows operating\nsystem were not displayed properly when accessed with SquirrelMail; the\n\"!=null\" string was trimmed to \"!ull\". This bug has been fixed and the\nattachments are now displayed correctly in such a case. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger than\n2^31 bytes were unreadable when using the squirrelmail package. With this\npatch the squirrelmail package is able to read all messages regardless of\nthe UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set to\nrequested variables. Consequently, SquirrelMail could not display any\ne-mails. The underlying source code has been modified and now the\nsquirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the i18n.php\nfile, the squirrelmail package could not use the GB 2312 character set. The\ni18n.php file has been fixed and the GB 2312 character set works correctly\nin the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled constant,\nPREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error\nmessages. The name of the constant has been corrected to\nPREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in\nthis scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from\nthe SquirrelMail web interface was blocked. This update adds a note to the\nSquirrelMail documentation that describes how to set the SELinux options to\nallow sending e-mails from the SquirrelMail web interface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC 2822\nspecification about line length limits. Consequently, attachments with\nlines longer than 998 characters could not be forwarded using SquirrelMail.\nThis patch modifies the underlying source code and now SquirrelMail\ncomplies with the RFC 2822 specification as expected. (BZ#745469)\n\n* Prior to this update, the squirrelmail package required the php-common\nscript instead of the mod_php script during installation or upgrade of the\npackage, which led to a dependency error. As a result, attempting to\ninstall or upgrade the squirrelmail package failed on systems using the\nphp53 packages. With this update, the dependencies of the squirrelmail\npackage were changed and the installation or upgrade now works correctly in\nthe described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated package,\nwhich contains backported patches to correct these issues.\n\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2013-January/081339.html\nhttps://lists.centos.org/pipermail/centos-cr-announce/2013-January/026709.html\n\n**Affected packages:**\nsquirrelmail\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2013:0126", "cvss3": {}, "published": "2013-01-09T20:54:52", "type": "centos", "title": "squirrelmail security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2013-01-11T13:19:06", "id": "CESA-2013:0126", "href": "https://lists.centos.org/pipermail/centos-announce/2013-January/081339.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "osv": [{"lastseen": "2023-06-28T06:47:09", "description": "\nVarious vulnerabilities have been found in SquirrelMail, a webmail\napplication. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:\n\n\n* [CVE-2010-4554](https://security-tracker.debian.org/tracker/CVE-2010-4554)\nSquirrelMail did not prevent page rendering inside a third-party\n HTML frame, which makes it easier for remote attackers to conduct\n clickjacking attacks via a crafted web site.\n* [CVE-2010-4555](https://security-tracker.debian.org/tracker/CVE-2010-4555), \n [CVE-2011-2752](https://security-tracker.debian.org/tracker/CVE-2011-2752), \n [CVE-2011-2753](https://security-tracker.debian.org/tracker/CVE-2011-2753)\nMultiple small bugs in SquirrelMail allowed an attacker to inject\n malicious script into various pages or alter the contents of user\n preferences.\n* [CVE-2011-2023](https://security-tracker.debian.org/tracker/CVE-2011-2023)\nIt was possible to inject arbitrary web script or HTML via a\n crafted STYLE element in an HTML part of an e-mail message.\n\n\nFor the oldstable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny5.\n\n\nFor the stable distribution (squeeze), these problems have been fixed in\nversion 1.4.21-2.\n\n\nFor the testing (wheezy) and unstable distribution (sid), these problems\nhave been fixed in version 1.4.22-1.\n\n\nWe recommend that you upgrade your squirrelmail packages.\n\n\n", "cvss3": {}, "published": "2011-08-08T00:00:00", "type": "osv", "title": "squirrelmail - various issues", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2023-06-28T06:46:58", "id": "OSV:DSA-2291-1", "href": "https://osv.dev/vulnerability/DSA-2291-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-28T06:31:32", "description": "\nSquirrelMail, a webmail application, does not employ a user-specific token \nfor webforms. This allows a remote attacker to perform a Cross Site Request \nForgery (CSRF) attack. The attacker may hijack the authentication of \nunspecified victims and send messages or change user preferences among other \nactions, by tricking the victim into following a link controlled by the \noffender.\n\n\nIn addition, a denial-of-service was fixed, which could be triggered when a \npassword containing 8-bit characters was used to log in ([CVE-2010-2813](https://security-tracker.debian.org/tracker/CVE-2010-2813)).\n\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny3.1.\n\n\nFor the testing distribution (squeeze) and the unstable distribution (sid),\nthese problems have been fixed in version 1.4.21-1.\n\n\nWe recommend that you upgrade your squirrelmail packages.\n\n\n", "cvss3": {}, "published": "2010-08-12T00:00:00", "type": "osv", "title": "squirrelmail - cross-site request forgery", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813"], "modified": "2023-06-28T06:31:28", "id": "OSV:DSA-2091-1", "href": "https://osv.dev/vulnerability/DSA-2091-1", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "debian": [{"lastseen": "2023-12-05T12:27:49", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2291-1 security@debian.org\nhttp://www.debian.org/security/ Thijs Kinkhorst\nAugust 8, 2011 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : squirrelmail\nVulnerability : various\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2010-4554 CVE-2010-4555 CVE-2011-2023\n CVE-2011-2752 CVE-2011-2753\n\nVarious vulnerabilities have been found in SquirrelMail, a webmail\napplication. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:\n\nCVE-2010-4554\n\n SquirrelMail did not prevent page rendering inside a third-party\n HTML frame, which makes it easier for remote attackers to conduct\n clickjacking attacks via a crafted web site. \n\nCVE-2010-4555, CVE-2011-2752, CVE-2011-2753\n\n Multiple small bugs in SquirrelMail allowed an attacker to inject\n malicious script into various pages or alter the contents of user\n preferences.\n\nCVE-2011-2023\n\n It was possible to inject arbitrary web script or HTML via a\n crafted STYLE element in an HTML part of an e-mail message.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 1.4.15-4+lenny5.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1.4.21-2.\n\nFor the testing (wheezy) and unstable distribution (sid), these problems\nhave been fixed in version 1.4.22-1.\n\nWe recommend that you upgrade your squirrelmail packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2011-08-08T11:24:38", "type": "debian", "title": "[SECURITY] [DSA 2291-1] squirrelmail security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023", "CVE-2011-2752", "CVE-2011-2753"], "modified": "2011-08-08T11:24:38", "id": "DEBIAN:DSA-2291-1:B447A", "href": "https://lists.debian.org/debian-security-announce/2011/msg00165.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-05T12:36:41", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-2091-1 security@debian.org\nhttp://www.debian.org/security/ Luciano Bello\nAugust 12, 2010 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : squirrelmail\nVulnerability : No user-specific token implemented\nProblem type : remote\nDebian-specific: no\nDebian bug : 543818\nCVE ID : CVE-2009-2964 CVE-2010-2813\n\nSquirrelMail, a webmail application, does not employ a user-specific token \nfor webforms. This allows a remote attacker to perform a Cross Site Request \nForgery (CSRF) attack. The attacker may hijack the authentication of \nunspecified victims and send messages or change user preferences among other \nactions, by tricking the victim into following a link controled by the \noffender.\n\nIn addition, a denial-of-service was fixed, which could be triggered when a \npasswords containing 8-bit characters was used to log in (CVE-2010-2813).\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny3.1.\n\nFor the testing distribution (squeeze) and the unstable distribution (sid),\nthese problems have been fixed in version 1.4.21-1.\n\nWe recommend that you upgrade your squirrelmail packages.\n\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15-4+lenny3.1.diff.gz\n Size/MD5 checksum: 34647 2251562662703a0d8e4f0de309ca60a6\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15.orig.tar.gz\n Size/MD5 checksum: 621320 87b466fef98e770307afffd75fe25589\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15-4+lenny3.1.dsc\n Size/MD5 checksum: 1240 a4e2ab21379259946f02a1d30831fe6d\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15-4+lenny3.1_all.deb\n Size/MD5 checksum: 615152 d08549fd86ffec2ae16b36e358f50cd6\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;", "cvss3": {}, "published": "2010-08-12T20:20:02", "type": "debian", "title": "[SECURITY] [DSA 2091-1] New squirrelmail packages fix cross-site request forgery", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-2964", "CVE-2010-2813"], "modified": "2010-08-12T20:20:02", "id": "DEBIAN:DSA-2091-1:23614", "href": "https://lists.debian.org/debian-security-announce/2010/msg00136.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "securityvulns": [{"lastseen": "2021-06-08T19:03:23", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "cvss3": {}, "published": "2011-08-12T00:00:00", "type": "securityvulns", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-2753", "CVE-2011-2133", "CVE-2011-2752", "CVE-2011-2023", "CVE-2010-4554", "CVE-2010-4555"], "modified": "2011-08-12T00:00:00", "id": "SECURITYVULNS:VULN:11853", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11853", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:36", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- ------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2091-1 security@debian.org\r\nhttp://www.debian.org/security/ Luciano Bello\r\nAugust 12, 2010 http://www.debian.org/security/faq\r\n- ------------------------------------------------------------------------\r\n\r\nPackage : squirrelmail\r\nVulnerability : No user-specific token implemented\r\nProblem type : remote\r\nDebian-specific: no\r\nDebian bug : 543818\r\nCVE ID : CVE-2009-2964 CVE-2010-2813\r\n\r\nSquirrelMail, a webmail application, does not employ a user-specific token \r\nfor webforms. This allows a remote attacker to perform a Cross Site Request \r\nForgery &#40;CSRF&#41; attack. The attacker may hijack the authentication of \r\nunspecified victims and send messages or change user preferences among other \r\nactions, by tricking the victim into following a link controled by the \r\noffender.\r\n\r\nIn addition, a denial-of-service was fixed, which could be triggered when a \r\npasswords containing 8-bit characters was used to log in &#40;CVE-2010-2813&#41;.\r\n\r\nFor the stable distribution &#40;lenny&#41;, these problems have been fixed in\r\nversion 1.4.15-4+lenny3.1.\r\n\r\nFor the testing distribution &#40;squeeze&#41; and the unstable distribution &#40;sid&#41;,\r\nthese problems have been fixed in version 1.4.21-1.\r\n\r\nWe recommend that you upgrade your squirrelmail packages.\r\n\r\n\r\nUpgrade instructions\r\n- --------------------\r\n\r\nwget url\r\n will fetch the file for you\r\ndpkg -i file.deb\r\n will install the referenced file.\r\n\r\nIf you are using the apt-get package manager, use the line for\r\nsources.list as given below:\r\n\r\napt-get update\r\n will update the internal database\r\napt-get upgrade\r\n will install corrected packages\r\n\r\nYou may use an automated update by adding the resources from the\r\nfooter to the proper configuration.\r\n\r\n\r\nDebian GNU/Linux 5.0 alias lenny\r\n- --------------------------------\r\n\r\nSource archives:\r\n\r\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15-4+lenny3.1.diff.gz\r\n Size/MD5 checksum: 34647 2251562662703a0d8e4f0de309ca60a6\r\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15.orig.tar.gz\r\n Size/MD5 checksum: 621320 87b466fef98e770307afffd75fe25589\r\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15-4+lenny3.1.dsc\r\n Size/MD5 checksum: 1240 a4e2ab21379259946f02a1d30831fe6d\r\n\r\nArchitecture independent packages:\r\n\r\n http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.15-4+lenny3.1_all.deb\r\n Size/MD5 checksum: 615152 d08549fd86ffec2ae16b36e358f50cd6\r\n\r\n\r\n These files will probably be moved into the stable distribution on\r\n its next update.\r\n\r\n- ---------------------------------------------------------------------------------\r\nFor apt-get: deb http://security.debian.org/ stable/updates main\r\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\r\nMailing list: debian-security-announce@lists.debian.org\r\nPackage info: &#96;apt-cache show &lt;pkg&gt;&#39; and http://packages.debian.org/&lt;pkg&gt;\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.10 &#40;GNU/Linux&#41;\r\n\r\niQEcBAEBAgAGBQJMZFbAAAoJEOxfUAG2iX57E9wH/2R7hpqY9l0OTtMT+TpEP6ld\r\nSWMx1rhE+Vf8nss3AKSx88uAn0szgS0zyVdBuGbksFsKDsLLAyreajwyqyNqYWdf\r\n+saBoZHbOXsE3xQUp1ceHJQ5LO3hPl8e7PlSfb91TVX0PTwjAbflIICGXNXjsT3j\r\n2gQRUWI8VtIbKNaTh0erSS2tU0CHdcWxcVjCmPLJxrDZ5jy9vTgiyc2secI6PLLQ\r\nuXpTBTC4ORRcui1L464cDb0a0xdX9s3qBu5PGydYwGyCMXsf4Vs8atejBUIK/XZq\r\n2aLNcAQuwNHttZtlRuig8LLmavpVEvDXErlFhETOd6UFCz5sVq9yfrMMT3ECli0=\r\n=9dTP\r\n-----END PGP SIGNATURE-----", "cvss3": {}, "published": "2010-08-14T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2091-1] New squirrelmail packages fix cross-site request forgery", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2010-2813", "CVE-2009-2964"], "modified": "2010-08-14T00:00:00", "id": "SECURITYVULNS:DOC:24526", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:24526", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2021-06-08T19:06:57", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "cvss3": {}, "published": "2010-08-14T00:00:00", "type": "securityvulns", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2010-2540", "CVE-2010-2539", "CVE-2010-2813", "CVE-2009-2964"], "modified": "2010-08-14T00:00:00", "id": "SECURITYVULNS:VULN:11070", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11070", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:03:09", "description": "Graphics, Video, Audio and documents parsing vulnerabilities. Information leakage, code execution via DNS resolver. Privilege escalation. Vulnerabilities in 3rd party packages.", "cvss3": {}, "published": "2012-02-03T00:00:00", "type": "securityvulns", "title": "Apple OS X multiple security vulnerabilities", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-3462", "CVE-2011-3448", "CVE-2011-1148", "CVE-2011-3444", "CVE-2011-1783", "CVE-2011-3246", "CVE-2011-3249", "CVE-2011-3189", "CVE-2011-0241", "CVE-2011-1752", "CVE-2011-1938", "CVE-2011-3449", "CVE-2011-3441", "CVE-2011-3453", "CVE-2011-3422", "CVE-2011-3248", "CVE-2011-2483", "CVE-2011-3457", "CVE-2010-2813", "CVE-2011-3463", "CVE-2011-3389", "CVE-2011-2204", "CVE-2011-3256", "CVE-2011-1657", "CVE-2011-1167", "CVE-2011-3252", "CVE-2011-3268", "CVE-2011-3328", "CVE-2011-2023", "CVE-2011-3182", "CVE-2010-4554", "CVE-2011-1921", "CVE-2011-3459", "CVE-2010-4555", "CVE-2011-3250", "CVE-2011-0200", "CVE-2011-3267", "CVE-2011-3458", "CVE-2011-3447", "CVE-2011-3460", "CVE-2011-2202", "CVE-2011-3452", "CVE-2011-3450", "CVE-2011-2895", "CVE-2010-1637", "CVE-2011-2937", "CVE-2011-2192"], "modified": "2012-02-03T00:00:00", "id": "SECURITYVULNS:VULN:12164", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:12164", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:43", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\nAPPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001\r\n\r\nOS X Lion v10.7.3 and Security Update 2012-001 is now available and\r\naddresses the following:\r\n\r\nAddress Book\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: An attacker in a privileged network position may intercept\r\nCardDAV data\r\nDescription: Address Book supports Secure Sockets Layer &#40;SSL&#41; for\r\naccessing CardDAV. A downgrade issue caused Address Book to attempt\r\nan unencrypted connection if an encrypted connection failed. An\r\nattacker in a privileged network position could abuse this behavior\r\nto intercept CardDAV data. This issue is addressed by not downgrading\r\nto an unencrypted connection without user approval.\r\nCVE-ID\r\nCVE-2011-3444 : Bernard Desruisseaux of Oracle Corporation\r\n\r\nApache\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Multiple vulnerabilities in Apache\r\nDescription: Apache is updated to version 2.2.21 to address several\r\nvulnerabilities, the most serious of which may lead to a denial of\r\nservice. Further information is available via the Apache web site at\r\nhttp://httpd.apache.org/\r\nCVE-ID\r\nCVE-2011-3348\r\n\r\nApache\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: An attacker may be able to decrypt data protected by SSL\r\nDescription: There are known attacks on the confidentiality of SSL\r\n3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode.\r\nApache disabled the &#39;empty fragment&#39; countermeasure which prevented\r\nthese attacks. This issue is addressed by providing a configuration\r\nparameter to control the countermeasure and enabling it by default.\r\nCVE-ID\r\nCVE-2011-3389\r\n\r\nCFNetwork\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: Visiting a maliciously crafted website may lead to the\r\ndisclosure of sensitive information\r\nDescription: An issue existed in CFNetwork&#39;s handling of malformed\r\nURLs. When accessing a maliciously crafted URL, CFNetwork could send\r\nthe request to an incorrect origin server. This issue does not affect\r\nsystems prior to OS X Lion.\r\nCVE-ID\r\nCVE-2011-3246 : Erling Ellingsen of Facebook\r\n\r\nCFNetwork\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: Visiting a maliciously crafted website may lead to the\r\ndisclosure of sensitive information\r\nDescription: An issue existed in CFNetwork&#39;s handling of malformed\r\nURLs. When accessing a maliciously crafted URL, CFNetwork could send\r\nunexpected request headers. This issue does not affect systems prior\r\nto OS X Lion.\r\nCVE-ID\r\nCVE-2011-3447 : Erling Ellingsen of Facebook\r\n\r\nColorSync\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\r\nImpact: Viewing a maliciously crafted image with an embedded\r\nColorSync profile may lead to an unexpected application termination\r\nor arbitrary code execution\r\nDescription: An integer overflow existed in the handling of images\r\nwith an embedded ColorSync profile, which may lead to a heap buffer\r\noverflow. This issue does not affect OS X Lion systems.\r\nCVE-ID\r\nCVE-2011-0200 : binaryproof working with TippingPoint&#39;s Zero Day\r\nInitiative\r\n\r\nCoreAudio\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\r\nImpact: Playing maliciously crafted audio content may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in the handling of AAC\r\nencoded audio streams. This issue does not affect OS X Lion systems.\r\nCVE-ID\r\nCVE-2011-3252 : Luigi Auriemma working with TippingPoint&#39;s Zero Day\r\nInitiative\r\n\r\nCoreMedia\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted movie file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A heap buffer overflow existed in CoreMedia&#39;s handling\r\nof H.264 encoded movie files.\r\nCVE-ID\r\nCVE-2011-3448 : Scott Stender of iSEC Partners\r\n\r\nCoreText\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing or downloading a document containing a maliciously\r\ncrafted embedded font may lead to an unexpected application\r\ntermination or arbitrary code execution\r\nDescription: A use after free issue existed in the handling of font\r\nfiles.\r\nCVE-ID\r\nCVE-2011-3449 : Will Dormann of the CERT/CC\r\n\r\nCoreUI\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: Visiting a malicious website may lead to an unexpected\r\napplication termination or arbitrary code execution\r\nDescription: An unbounded stack allocation issue existed in the\r\nhandling of long URLs. This issue does not affect systems prior to OS\r\nX Lion.\r\nCVE-ID\r\nCVE-2011-3450 : Ben Syverson\r\n\r\ncurl\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: A remote server may be able to impersonate clients via\r\nGSSAPI requests\r\nDescription: When doing GSSAPI authentication, libcurl\r\nunconditionally performs credential delegation. This issue is\r\naddressed by disabling GSSAPI credential delegation.\r\nCVE-ID\r\nCVE-2011-2192\r\n\r\nData Security\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: An attacker with a privileged network position may intercept\r\nuser credentials or other sensitive information\r\nDescription: Two certificate authorities in the list of trusted root\r\ncertificates have independently issued intermediate certificates to\r\nDigiCert Malaysia. DigiCert Malaysia has issued certificates with\r\nweak keys that it is unable to revoke. An attacker with a privileged\r\nnetwork position could intercept user credentials or other sensitive\r\ninformation intended for a site with a certificate issued by DigiCert\r\nMalaysia. This issue is addressed by configuring default system trust\r\nsettings so that DigiCert Malaysia&#39;s certificates are not trusted. We\r\nwould like to acknowledge Bruce Morton of Entrust, Inc. for reporting\r\nthis issue.\r\n\r\ndovecot\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: An attacker may be able to decrypt data protected by SSL\r\nDescription: There are known attacks on the confidentiality of SSL\r\n3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode.\r\nDovecot disabled the &#39;empty fragment&#39; countermeasure which prevented\r\nthese attacks. This issue is addressed by enabling the\r\ncountermeasure.\r\nCVE-ID\r\nCVE-2011-3389 : Apple\r\n\r\nfilecmds\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Decompressing a maliciously crafted compressed file may lead\r\nto an unexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in the &#39;uncompress&#39; command\r\nline tool.\r\nCVE-ID\r\nCVE-2011-2895\r\n\r\nImageIO\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\r\nImpact: Viewing a maliciously crafted TIFF file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in ImageIO&#39;s handling of\r\nCCITT Group 4 encoded TIFF files. This issue does not affect OS X\r\nLion systems.\r\nCVE-ID\r\nCVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies\r\n\r\nImageIO\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted TIFF file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in libtiff&#39;s handling of\r\nThunderScan encoded TIFF images. This issue is address by updating\r\nlibtiff to version 3.9.5.\r\nCVE-ID\r\nCVE-2011-1167\r\n\r\nImageIO\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Multiple vulnerabilities in libpng 1.5.4\r\nDescription: libpng is updated to version 1.5.5 to address multiple\r\nvulnerabilities, the most serious of which may lead to arbitrary code\r\nexecution. Further information is available via the libpng website at\r\nhttp://www.libpng.org/pub/png/libpng.html\r\nCVE-ID\r\nCVE-2011-3328\r\n\r\nInternet Sharing\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: A Wi-Fi network created by Internet Sharing may lose\r\nsecurity settings after a system update\r\nDescription: After updating to a version of OS X Lion prior to\r\n10.7.3, the Wi-Fi configuration used by Internet Sharing may revert\r\nto factory defaults, which disables the WEP password. This issue only\r\naffects systems with Internet Sharing enabled and sharing the\r\nconnection to Wi-Fi. This issue is addressed by preserving the Wi-Fi\r\nconfiguration during a system update.\r\nCVE-ID\r\nCVE-2011-3452 : an anonymous researcher\r\n\r\nLibinfo\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: Visiting a maliciously crafted website may lead to the\r\ndisclosure of sensitive information\r\nDescription: An issue existed in Libinfo&#39;s handling of hostname\r\nlookup requests. Libinfo could return incorrect results for a\r\nmaliciously crafted hostname. This issue does not affect systems\r\nprior to OS X Lion.\r\nCVE-ID\r\nCVE-2011-3441 : Erling Ellingsen of Facebook\r\n\r\nlibresolv\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Applications that use OS X&#39;s libresolv library may be\r\nvulnerable to an unexpected application termination or arbitrary code\r\nexecution\r\nDescription: An integer overflow existed in the parsing of DNS\r\nresource records, which may lead to heap memory corruption.\r\nCVE-ID\r\nCVE-2011-3453 : Ilja van Sprundel of IOActive\r\n\r\nlibsecurity\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Some EV certificates may be trusted even if the\r\ncorresponding root has been marked as untrusted\r\nDescription: The certificate code trusted a root certificate to sign\r\nEV certificates if it was on the list of known EV issuers, even if\r\nthe user had marked it as &#39;Never Trust&#39; in Keychain. The root would\r\nnot be trusted to sign non-EV certificates.\r\nCVE-ID\r\nCVE-2011-3422 : Alastair Houghton\r\n\r\nOpenGL\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Applications that use OS X&#39;s OpenGL implementation may be\r\nvulnerable to an unexpected application termination or arbitrary code\r\nexecution\r\nDescription: Multiple memory corruption issues existed in the\r\nhandling of GLSL compilation.\r\nCVE-ID\r\nCVE-2011-3457 : Chris Evans of the Google Chrome Security Team, and\r\nMarc Schoenefeld of the Red Hat Security Response Team\r\n\r\nPHP\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Multiple vulnerabilities in PHP 5.3.6\r\nDescription: PHP is updated to version 5.3.8 to address several\r\nvulnerabilities, the most serious of which may lead to arbitrary code\r\nexecution. Further information is available via the PHP web site at\r\nhttp://www.php.net\r\nCVE-ID\r\nCVE-2011-1148\r\nCVE-2011-1657\r\nCVE-2011-1938\r\nCVE-2011-2202\r\nCVE-2011-2483\r\nCVE-2011-3182\r\nCVE-2011-3189\r\nCVE-2011-3267\r\nCVE-2011-3268\r\n\r\nPHP\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted PDF file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in FreeType&#39;s\r\nhandling of Type 1 fonts. This issue is addressed by updating\r\nFreeType to version 2.4.7. Further information is available via the\r\nFreeType site at http://www.freetype.org/\r\nCVE-ID\r\nCVE-2011-3256 : Apple\r\n\r\nPHP\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Multiple vulnerabilities in libpng 1.5.4\r\nDescription: libpng is updated to version 1.5.5 to address multiple\r\nvulnerabilities, the most serious of which may lead to arbitrary code\r\nexecution. Further information is available via the libpng website at\r\nhttp://www.libpng.org/pub/png/libpng.html\r\nCVE-ID\r\nCVE-2011-3328\r\n\r\nQuickTime\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Opening a maliciously crafted MP4 encoded file may lead to\r\nan unexpected application termination or arbitrary code execution\r\nDescription: An uninitialized memory access issue existed in the\r\nhandling of MP4 encoded files.\r\nCVE-ID\r\nCVE-2011-3458 : Luigi Auriemma and pa_kt both working with\r\nTippingPoint&#39;s Zero Day Initiative\r\n\r\nQuickTime\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted movie file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A signedness issue existed in the handling of font\r\ntables embedded in QuickTime movie files.\r\nCVE-ID\r\nCVE-2011-3248 : Luigi Auriemma working with TippingPoint&#39;s Zero Day\r\nInitiative\r\n\r\nQuickTime\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted movie file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: An off by one buffer overflow existed in the handling\r\nof rdrf atoms in QuickTime movie files.\r\nCVE-ID\r\nCVE-2011-3459 : Luigi Auriemma working with TippingPoint&#39;s Zero Day\r\nInitiative\r\n\r\nQuickTime\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted JPEG2000 image file may lead\r\nto an unexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in the handling of JPEG2000\r\nfiles.\r\nCVE-ID\r\nCVE-2011-3250 : Luigi Auriemma working with TippingPoint&#39;s Zero Day\r\nInitiative\r\n\r\nQuickTime\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Processing a maliciously crafted PNG image may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in the handling of PNG files.\r\nCVE-ID\r\nCVE-2011-3460 : Luigi Auriemma working with TippingPoint&#39;s Zero Day\r\nInitiative\r\n\r\nQuickTime\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted movie file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A buffer overflow existed in the handling of FLC\r\nencoded movie files\r\nCVE-ID\r\nCVE-2011-3249 : Matt &#39;j00ru&#39; Jurczyk working with TippingPoint&#39;s Zero\r\nDay Initiative\r\n\r\nSquirrelMail\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\r\nImpact: Multiple vulnerabilities in SquirrelMail\r\nDescription: SquirrelMail is updated to version 1.4.22 to address\r\nseveral vulnerabilities, the most serious of which is a cross-site\r\nscripting issue. This issue does not affect OS X Lion systems.\r\nFurther information is available via the SquirrelMail web site at\r\nhttp://www.SquirrelMail.org/\r\nCVE-ID\r\nCVE-2010-1637\r\nCVE-2010-2813\r\nCVE-2010-4554\r\nCVE-2010-4555\r\nCVE-2011-2023\r\n\r\nSubversion\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Accessing a Subversion repository may lead to the disclosure\r\nof sensitive information\r\nDescription: Subversion is updated to version 1.6.17 to address\r\nmultiple vulnerabilities, the most serious of which may lead to the\r\ndisclosure of sensitive information. Further information is available\r\nvia the Subversion web site at http://subversion.tigris.org/\r\nCVE-ID\r\nCVE-2011-1752\r\nCVE-2011-1783\r\nCVE-2011-1921\r\n\r\nTime Machine\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: A remote attacker may access new backups created by the\r\nuser&#39;s system\r\nDescription: The user may designate a remote AFP volume or Time\r\nCapsule to be used for Time Machine backups. Time Machine did not\r\nverify that the same device was being used for subsequent backup\r\noperations. An attacker who is able to spoof the remote volume could\r\ngain access to new backups created by the user&#39;s system. This issue\r\nis addressed by verifying the unique identifier associated with a\r\ndisk for backup operations.\r\nCVE-ID\r\nCVE-2011-3462 : Michael Roitzsch of the Technische Universitat\r\nDresden\r\n\r\nTomcat\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\r\nImpact: Multiple vulnerabilities in Tomcat 6.0.32\r\nDescription: Tomcat is updated to version 6.0.33 to address multiple\r\nvulnerabilities, the most serious of which may lead to the disclosure\r\nof sensitive information. Tomcat is only provided on Mac OS X Server\r\nsystems. This issue does not affect OS X Lion systems. Further\r\ninformation is available via the Tomcat site at\r\nhttp://tomcat.apache.org/\r\nCVE-ID\r\nCVE-2011-2204\r\n\r\nWebDAV Sharing\r\nAvailable for: OS X Lion Server v10.7 to v10.7.2\r\nImpact: Local users may obtain system privileges\r\nDescription: An issue existed in WebDAV Sharing&#39;s handling of user\r\nauthentication. A user with a valid account on the server or one of\r\nits bound directories could cause the execution of arbitrary code\r\nwith system privileges. This issue does not affect systems prior to\r\nOS X Lion.\r\nCVE-ID\r\nCVE-2011-3463 : Gordon Davisson of Crywolf\r\n\r\nWebmail\r\nAvailable for: OS X Lion v10.7 to v10.7.2,\r\nOS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted e-mail message may lead to the\r\ndisclosure of message content\r\nDescription: A cross-site scripting vulnerability existed in the\r\nhandling of mail messages. This issue is addressed by updating\r\nRoundcube Webmail to version 0.6. This issue does not affect systems\r\nprior to OS X Lion. Further information is available via the\r\nRoundcube site at http://trac.roundcube.net/\r\nCVE-ID\r\nCVE-2011-2937\r\n\r\nX11\r\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\r\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\r\nImpact: Viewing a maliciously crafted PDF file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in FreeType&#39;s\r\nhandling of Type 1 fonts. This issue is addressed by updating\r\nFreeType to version 2.4.7. Further information is available via the\r\nFreeType site at http://www.freetype.org/\r\nCVE-ID\r\nCVE-2011-3256 : Apple\r\n\r\nOS X Lion v10.7.3 and Security Update 2012-001 may be obtained from\r\nthe Software Update pane in System Preferences, or Apple&#39;s Software\r\nDownloads web site:\r\nhttp://www.apple.com/support/downloads/\r\n\r\nThe Software Update utility will present the update that applies\r\nto your system configuration. Only one is needed, either\r\nSecurity Update 2021-001 or OS X v10.7.3.\r\n\r\nFor OS X Lion v10.7.2\r\nThe download file is named: MacOSXUpd10.7.3.dmg\r\nIts SHA-1 digest is: 7102fe8f9f47286c45dfa35f6e84e7f730493a7c\r\n\r\nFor OS X Lion v10.7 and v10.7.1\r\nThe download file is named: MacOSXUpdCombo10.7.3.dmg\r\nIts SHA-1 digest is: 07dfce300f6801eb63d9ac13e0bec84e1862a16c\r\n\r\nFor OS X Lion Server v10.7.2\r\nThe download file is named: MacOSXServerUpd10.7.3.dmg\r\nIts SHA-1 digest is: 55a9571635d4ec088c142d68132d0d69fcb8867d\r\n\r\nFor OS X Lion Server v10.7 and v10.7.1\r\nThe download file is named: MacOSXServerUpdCombo10.7.3.dmg\r\nIts SHA-1 digest is: 2c87824f09734499ea166ea0617a3ac21ecf832b\r\n\r\nFor Mac OS X v10.6.8\r\nThe download file is named: SecUpd2012-001Snow.dmg\r\nIts SHA-1 digest is: 40875ee8cb609bbaefc8f421a9c34cc353db42b8\r\n\r\nFor Mac OS X Server v10.6.8\r\nThe download file is named: SecUpdSrvr2012-001.dmg\r\nIts SHA-1 digest is: 53b3ca5548001a9920aeabed4a034c6e4657fe20\r\n\r\nInformation will also be posted to the Apple Security Updates\r\nweb site: http://support.apple.com/kb/HT1222\r\n\r\nThis message is signed with Apple&#39;s Product Security PGP key,\r\nand details are available at:\r\nhttps://www.apple.com/support/security/pgp/\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG/MacGPG2 v2.0.16 &#40;Darwin&#41;\r\n\r\niQEcBAEBAgAGBQJPKYxNAAoJEGnF2JsdZQeeLiIIAMLhH2ipDFrhCsw/n4VDeF1V\r\nP6jSkGXC9tBBVMvw1Xq4c2ok4SI34bDfMlURAVR+dde/h6nIZR24aLQVoDLjJuIp\r\nRrO2dm1nQeozLJSx2NbxhVh54BucJdKp4xS1GkDNxkqcdh04RE9hRURXdKagnfGy\r\n9P8QQPOQmKAiWos/LYhCPDInMfrpVNvEVwP8MCDP15g6hylN4De/Oyt7ZshPshSf\r\nMnAFObfBTGX5KioVqTyfdlBkKUfdXHJux61QEFHn8eadX6+/6IuKbUvK9B0icc8E\r\npvbjOxQatFRps0KNWeIsKQc5i6iQoJhocAiIy6Y6LCuZQuSXCImY2RWXkVYzbWo=\r\n=c1eU\r\n-----END PGP SIGNATURE-----\r\n", "cvss3": {}, "published": "2012-02-03T00:00:00", "type": "securityvulns", "title": "APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-3462", "CVE-2011-3448", "CVE-2011-1148", "CVE-2011-3444", "CVE-2011-1783", "CVE-2011-3246", "CVE-2011-3249", "CVE-2011-3189", "CVE-2011-0241", "CVE-2011-1752", "CVE-2011-1938", "CVE-2011-3449", "CVE-2011-3441", "CVE-2011-3453", "CVE-2011-3422", "CVE-2011-3248", "CVE-2011-2483", "CVE-2011-3457", "CVE-2010-2813", "CVE-2011-3463", "CVE-2011-3389", "CVE-2011-2204", "CVE-2011-3256", "CVE-2011-1657", "CVE-2011-1167", "CVE-2011-3252", "CVE-2011-3268", "CVE-2011-3328", "CVE-2011-2023", "CVE-2011-3182", "CVE-2010-4554", "CVE-2011-1921", "CVE-2011-3459", "CVE-2010-4555", "CVE-2011-3250", "CVE-2011-0200", "CVE-2011-3267", "CVE-2011-3458", "CVE-2011-3447", "CVE-2011-3460", "CVE-2011-3348", "CVE-2011-2202", "CVE-2011-3452", "CVE-2011-3450", "CVE-2011-2895", "CVE-2010-1637", "CVE-2011-2937", "CVE-2011-2192"], "modified": "2012-02-03T00:00:00", "id": "SECURITYVULNS:DOC:27600", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27600", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "seebug": [{"lastseen": "2017-11-19T18:03:08", "description": "CVE ID\uff1aCVE-2010-4554\r\nCVE-2010-4555\r\nCVE-2011-2023\r\n\r\nSquirrelMail\u662f\u4e00\u6b3e\u57fa\u4e8ePHP\u7684WEB\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\r\nSquirrelMail\u5b58\u5728\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u6076\u610f\u7528\u6237\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u6ce8\u5165\u653b\u51fb\uff0c\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\u7b49\u653b\u51fb\u3002\r\n1)\u90e8\u5206\u4f20\u9012\u7ed9\u6d88\u606f\u4e2d\u6837\u5f0f\u6807\u7b7e\u7684\u8f93\u5165\u5728functions/mime.php\u4f7f\u7528\u4e4b\u524d\u7f3a\u5c11\u8fc7\u6ee4\uff0c\u53ef\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002\r\n2)\u90e8\u5206\u4f20\u9012\u7ed9\u4e0b\u62c9\u9009\u62e9\u5217\u8868\u7684\u90e8\u5206\u8f93\u5165\u5728functions/options.php\u4f7f\u7528\u4e4b\u524d\u7f3a\u5c11\u8fc7\u6ee4\uff0c\u53ef\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002\r\n3)\u90e8\u5206\u4f20\u9012\u7ed9SquirrelSpell\u62fc\u5199\u68c0\u67e5\u529f\u80fd\u7684\u90e8\u5206\u8f93\u5165\u548c\u7d22\u5f15\u6392\u5e8f\u9875\u5728\u8fd4\u56de\u7528\u6237\u4e4b\u524d\u7f3a\u5c11\u8fc7\u6ee4\uff0c\u53ef\u5bfc\u81f4\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002\r\n4)\u5e94\u7528\u7a0b\u5e8f\u5b58\u5728\u4e00\u4e2a\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u653b\u51fb\uff0c\u6784\u5efa\u6076\u610f\u94fe\u63a5\uff0c\u8bf1\u4f7f\u7528\u6237\u70b9\u51fb\u53ef\u83b7\u5f97\u7528\u6237\u5bc6\u7801\u7b49\u4fe1\u606f\u3002\n\nSquirrelMail 1.x\n\u5382\u5546\u89e3\u51b3\u65b9\u6848\r\n\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www.squirrelmail.org/security/issue/2011-07-10\r\n http://www.squirrelmail.org/security/issue/2011-07-11\r\n http://www.squirrelmail.org/security/issue/2011-07-12", "cvss3": {}, "published": "2011-07-14T00:00:00", "type": "seebug", "title": "SquirrelMail 1.x \u5b58\u5728\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023"], "modified": "2011-07-14T00:00:00", "id": "SSV:20730", "href": "https://www.seebug.org/vuldb/ssvid-20730", "sourceData": "", "sourceHref": "", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2011-07-23T02:10:11", "type": "fedora", "title": "[SECURITY] Fedora 14 Update: squirrelmail-1.4.22-2.fc14", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023"], "modified": "2011-07-23T02:10:11", "id": "FEDORA:1EB69111183", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TDBJFYFLDC6KNLJCQ7Q2M2WCA5XE3CBE/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2011-07-23T01:57:40", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: squirrelmail-1.4.22-2.fc15", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554", "CVE-2010-4555", "CVE-2011-2023"], "modified": "2011-07-23T01:57:40", "id": "FEDORA:F30E111118B", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VKR4EBJM4T5QJJPUYVWGDBNQI7I7S2TH/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2010-08-12T04:08:08", "type": "fedora", "title": "[SECURITY] Fedora 12 Update: squirrelmail-1.4.21-1.fc12", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813"], "modified": "2010-08-12T04:08:08", "id": "FEDORA:1D01A11130D", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MFYDOSVXYBWHPQM4YMY43TWBYPM3QXQJ/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2010-08-12T04:11:47", "type": "fedora", "title": "[SECURITY] Fedora 13 Update: squirrelmail-1.4.21-1.fc13", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637", "CVE-2010-2813"], "modified": "2010-08-12T04:11:47", "id": "FEDORA:D55C11113FA", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KP4BGBD6BJQC32GBLWVFCH3MIGDVILSC/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2010-06-22T17:16:34", "type": "fedora", "title": "[SECURITY] Fedora 13 Update: squirrelmail-1.4.20-3.fc13", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2010-06-22T17:16:34", "id": "FEDORA:96703110DB8", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OGHUSB5MRSQQYRJF3ZOI5RZH75SOQVJH/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2010-06-22T17:17:53", "type": "fedora", "title": "[SECURITY] Fedora 11 Update: squirrelmail-1.4.20-2.fc11", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2010-06-22T17:17:53", "id": "FEDORA:5FF621106AE", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3QRTRHZ2PQNXO2LKWBYHX2EYOCBOM3NH/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:50", "description": "SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. ", "cvss3": {}, "published": "2010-06-22T17:13:19", "type": "fedora", "title": "[SECURITY] Fedora 12 Update: squirrelmail-1.4.20-3.fc12", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2010-06-22T17:13:19", "id": "FEDORA:0A9BE110E2F", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2H7HYJIYBJNVF6ULRXQRMAZYM56ZQHES/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2023-12-05T14:18:51", "description": "CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \\n (newline) character, a different vulnerability than CVE-2010-4555.", "cvss3": {}, "published": "2011-07-17T20:55:00", "type": "cve", "title": "CVE-2011-2752", "cwe": ["CWE-94"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555", "CVE-2011-2752"], "modified": "2017-08-29T01:29:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:0.2.1", "cpe:/a:squirrelmail:squirrelmail:0.1.1", "cpe:/a:squirrelmail:squirrelmail:1.2.4", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.4.3", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.21", "cpe:/a:squirrelmail:squirrelmail:1.2.11", "cpe:/a:squirrelmail:squirrelmail:1.2.2", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:0.5pre2", "cpe:/a:squirrelmail:squirrelmail:0.5pre1", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.1.3", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:1.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.2.10", "cpe:/a:squirrelmail:squirrelmail:1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:1.2.3", "cpe:/a:squirrelmail:squirrelmail:0.3pre2", "cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.6_cvs", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:1.1.1", "cpe:/a:squirrelmail:squirrelmail:1.3.0", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:0.5", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:1.0.4", "cpe:/a:squirrelmail:squirrelmail:0.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.4.5", "cpe:/a:squirrelmail:squirrelmail:1.0.5", "cpe:/a:squirrelmail:squirrelmail:0.3", "cpe:/a:squirrelmail:squirrelmail:1.0pre3", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:1.0pre1", "cpe:/a:squirrelmail:squirrelmail:0.4pre2", "cpe:/a:squirrelmail:squirrelmail:1.0.2", "cpe:/a:squirrelmail:squirrelmail:1.2.7", "cpe:/a:squirrelmail:squirrelmail:0.1.2", "cpe:/a:squirrelmail:squirrelmail:0.4", "cpe:/a:squirrelmail:squirrelmail:1.2.9", "cpe:/a:squirrelmail:squirrelmail:1.2.6", "cpe:/a:squirrelmail:squirrelmail:1.2.0", "cpe:/a:squirrelmail:squirrelmail:1.1.0", "cpe:/a:squirrelmail:squirrelmail:1.2.8", "cpe:/a:squirrelmail:squirrelmail:1.2.5", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:1.0.1", "cpe:/a:squirrelmail:squirrelmail:1.0.6", "cpe:/a:squirrelmail:squirrelmail:1.1.2", "cpe:/a:squirrelmail:squirrelmail:1.0", "cpe:/a:squirrelmail:squirrelmail:1.3.2", "cpe:/a:squirrelmail:squirrelmail:1.4.15rc1", "cpe:/a:squirrelmail:squirrelmail:1.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:0.2", "cpe:/a:squirrelmail:squirrelmail:0.3pre1", "cpe:/a:squirrelmail:squirrelmail:1.0pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:0.4pre1", "cpe:/a:squirrelmail:squirrelmail:1.0.3", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:1.4.19"], "id": "CVE-2011-2752", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2752", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:P"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.21:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*"]}, {"lastseen": "2023-12-05T14:18:53", "description": "Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.", "cvss3": {}, "published": "2011-07-17T20:55:00", "type": "cve", "title": "CVE-2011-2753", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555", "CVE-2011-2753"], "modified": "2017-08-29T01:29:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:0.2.1", "cpe:/a:squirrelmail:squirrelmail:0.1.1", "cpe:/a:squirrelmail:squirrelmail:1.2.4", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.4.3", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.21", "cpe:/a:squirrelmail:squirrelmail:1.2.11", "cpe:/a:squirrelmail:squirrelmail:1.2.2", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:0.5pre2", "cpe:/a:squirrelmail:squirrelmail:0.5pre1", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.1.3", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:1.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.2.10", "cpe:/a:squirrelmail:squirrelmail:1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:1.2.3", "cpe:/a:squirrelmail:squirrelmail:0.3pre2", "cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.6_cvs", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:1.1.1", "cpe:/a:squirrelmail:squirrelmail:1.3.0", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:0.5", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:1.0.4", "cpe:/a:squirrelmail:squirrelmail:0.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.4.5", "cpe:/a:squirrelmail:squirrelmail:1.0.5", "cpe:/a:squirrelmail:squirrelmail:0.3", "cpe:/a:squirrelmail:squirrelmail:1.0pre3", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:1.0pre1", "cpe:/a:squirrelmail:squirrelmail:0.4pre2", "cpe:/a:squirrelmail:squirrelmail:1.0.2", "cpe:/a:squirrelmail:squirrelmail:1.2.7", "cpe:/a:squirrelmail:squirrelmail:0.1.2", "cpe:/a:squirrelmail:squirrelmail:0.4", "cpe:/a:squirrelmail:squirrelmail:1.2.9", "cpe:/a:squirrelmail:squirrelmail:1.2.6", "cpe:/a:squirrelmail:squirrelmail:1.2.0", "cpe:/a:squirrelmail:squirrelmail:1.1.0", "cpe:/a:squirrelmail:squirrelmail:1.2.8", "cpe:/a:squirrelmail:squirrelmail:1.2.5", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:1.0.1", "cpe:/a:squirrelmail:squirrelmail:1.0.6", "cpe:/a:squirrelmail:squirrelmail:1.1.2", "cpe:/a:squirrelmail:squirrelmail:1.0", "cpe:/a:squirrelmail:squirrelmail:1.3.2", "cpe:/a:squirrelmail:squirrelmail:1.4.15rc1", "cpe:/a:squirrelmail:squirrelmail:1.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:0.2", "cpe:/a:squirrelmail:squirrelmail:0.3pre1", "cpe:/a:squirrelmail:squirrelmail:1.0pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:0.4pre1", "cpe:/a:squirrelmail:squirrelmail:1.0.3", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:1.4.19"], "id": "CVE-2011-2753", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2753", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.21:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T14:20:26", "description": "Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index Order (aka options_order) page.", "cvss3": {}, "published": "2011-07-14T23:55:00", "type": "cve", "title": "CVE-2010-4555", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555"], "modified": "2017-08-17T01:33:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:0.5pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:0.3.1", "cpe:/a:squirrelmail:squirrelmail:1.0pre1", "cpe:/a:squirrelmail:squirrelmail:1.1.1", "cpe:/a:squirrelmail:squirrelmail:1.0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.2.10", "cpe:/a:squirrelmail:squirrelmail:1.2.8", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:1.2.4", "cpe:/a:squirrelmail:squirrelmail:1.4.21", "cpe:/a:squirrelmail:squirrelmail:1.2.2", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.0.2", "cpe:/a:squirrelmail:squirrelmail:1.1.3", "cpe:/a:squirrelmail:squirrelmail:1.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:0.3pre1", "cpe:/a:squirrelmail:squirrelmail:0.4", "cpe:/a:squirrelmail:squirrelmail:0.1.2", "cpe:/a:squirrelmail:squirrelmail:1.1.2", "cpe:/a:squirrelmail:squirrelmail:1.0.4", "cpe:/a:squirrelmail:squirrelmail:1.2.9", "cpe:/a:squirrelmail:squirrelmail:1.1.0", "cpe:/a:squirrelmail:squirrelmail:0.3pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.2.5", "cpe:/a:squirrelmail:squirrelmail:1.2.0", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:1.0.3", "cpe:/a:squirrelmail:squirrelmail:0.2", "cpe:/a:squirrelmail:squirrelmail:0.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4.5", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:1.0", "cpe:/a:squirrelmail:squirrelmail:1.0pre2", "cpe:/a:squirrelmail:squirrelmail:1.2.3", "cpe:/a:squirrelmail:squirrelmail:1.4.3", "cpe:/a:squirrelmail:squirrelmail:0.4pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.15rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.0pre3", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:1.2.11", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:0.5pre1", "cpe:/a:squirrelmail:squirrelmail:0.1.1", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.3.0", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:0.5", "cpe:/a:squirrelmail:squirrelmail:1.0.6", "cpe:/a:squirrelmail:squirrelmail:1.2.7", "cpe:/a:squirrelmail:squirrelmail:0.3", "cpe:/a:squirrelmail:squirrelmail:1.0.5", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:1.2.6", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:1.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:0.4pre1", "cpe:/a:squirrelmail:squirrelmail:1.4.19", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:1.4.6_cvs", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.3.2"], "id": "CVE-2010-4555", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4555", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.21:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-04T14:11:30", "description": "The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.", "cvss3": {}, "published": "2010-06-22T17:30:00", "type": "cve", "title": "CVE-2010-1637", "cwe": ["CWE-264"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2012-02-14T03:55:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:1.2.9", "cpe:/a:squirrelmail:squirrelmail:1.0.5", "cpe:/a:squirrelmail:squirrelmail:1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:1.2.7", "cpe:/a:squirrelmail:squirrelmail:0.2", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:1.0.3", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:1.4.19", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.2.10", "cpe:/a:squirrelmail:squirrelmail:0.1", "cpe:/a:squirrelmail:squirrelmail:1.2.0", "cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:0.5", "cpe:/a:squirrelmail:squirrelmail:1.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:1.0.2", "cpe:/a:squirrelmail:squirrelmail:1.0.1", "cpe:/a:squirrelmail:squirrelmail:1.3.2", "cpe:/a:squirrelmail:squirrelmail:1.2.5", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:1.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:0.4", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.2.11", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:0.3", "cpe:/a:squirrelmail:squirrelmail:0.3.1", "cpe:/a:squirrelmail:squirrelmail:1.0pre2", "cpe:/a:squirrelmail:squirrelmail:1.0.6", "cpe:/a:squirrelmail:squirrelmail:1.0pre3", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:0.3pre2", "cpe:/a:squirrelmail:squirrelmail:1.0", "cpe:/a:squirrelmail:squirrelmail:1.44", "cpe:/a:squirrelmail:squirrelmail:1.1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.2.4", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:0.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:0.1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.4.3", "cpe:/a:squirrelmail:squirrelmail:0.5pre1", "cpe:/a:squirrelmail:squirrelmail:1.2.8", "cpe:/a:squirrelmail:squirrelmail:0.4pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:1.1.3", "cpe:/a:squirrelmail:squirrelmail:1.1.0", "cpe:/a:squirrelmail:squirrelmail:1.2.2", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:0.3pre1", "cpe:/a:squirrelmail:squirrelmail:1.2.6", "cpe:/a:squirrelmail:squirrelmail:1.0pre1", "cpe:/a:squirrelmail:squirrelmail:1.3.0", "cpe:/a:squirrelmail:squirrelmail:0.5pre2", "cpe:/a:squirrelmail:squirrelmail:0.1.1", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:0.4pre1", "cpe:/a:squirrelmail:squirrelmail:1.2.3", "cpe:/a:squirrelmail:squirrelmail:1.4.4_rc1", "cpe:/a:squirrelmail:squirrelmail:1.0.4", "cpe:/a:squirrelmail:squirrelmail:1.1.1", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:1.4.5"], "id": "CVE-2010-1637", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1637", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.44:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-03T14:20:27", "description": "functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.", "cvss3": {}, "published": "2011-07-14T23:55:00", "type": "cve", "title": "CVE-2010-4554", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554"], "modified": "2017-08-17T01:33:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:0.5pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:0.3.1", "cpe:/a:squirrelmail:squirrelmail:1.0pre1", "cpe:/a:squirrelmail:squirrelmail:1.1.1", "cpe:/a:squirrelmail:squirrelmail:1.0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.2.10", "cpe:/a:squirrelmail:squirrelmail:1.2.8", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:1.2.4", "cpe:/a:squirrelmail:squirrelmail:1.4.21", "cpe:/a:squirrelmail:squirrelmail:1.2.2", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.0.2", "cpe:/a:squirrelmail:squirrelmail:1.1.3", "cpe:/a:squirrelmail:squirrelmail:1.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:0.3pre1", "cpe:/a:squirrelmail:squirrelmail:0.4", "cpe:/a:squirrelmail:squirrelmail:0.1.2", "cpe:/a:squirrelmail:squirrelmail:1.1.2", "cpe:/a:squirrelmail:squirrelmail:1.0.4", "cpe:/a:squirrelmail:squirrelmail:1.2.9", "cpe:/a:squirrelmail:squirrelmail:1.1.0", "cpe:/a:squirrelmail:squirrelmail:0.3pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.2.5", "cpe:/a:squirrelmail:squirrelmail:1.2.0", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:1.0.3", "cpe:/a:squirrelmail:squirrelmail:0.2", "cpe:/a:squirrelmail:squirrelmail:0.2.1", "cpe:/a:squirrelmail:squirrelmail:1.4.5", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:1.0", "cpe:/a:squirrelmail:squirrelmail:1.0pre2", "cpe:/a:squirrelmail:squirrelmail:1.2.3", "cpe:/a:squirrelmail:squirrelmail:1.4.3", "cpe:/a:squirrelmail:squirrelmail:0.4pre2", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.15rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.0pre3", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:1.2.11", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:0.5pre1", "cpe:/a:squirrelmail:squirrelmail:0.1.1", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.3.0", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:0.5", "cpe:/a:squirrelmail:squirrelmail:1.0.6", "cpe:/a:squirrelmail:squirrelmail:1.2.7", "cpe:/a:squirrelmail:squirrelmail:0.3", "cpe:/a:squirrelmail:squirrelmail:1.0.5", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:1.2.6", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:1.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:0.4pre1", "cpe:/a:squirrelmail:squirrelmail:1.4.19", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:1.4.6_cvs", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.3.2"], "id": "CVE-2010-4554", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4554", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.21:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-04T14:16:42", "description": "functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.", "cvss3": {}, "published": "2010-08-19T18:00:00", "type": "cve", "title": "CVE-2010-2813", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813"], "modified": "2017-08-17T01:32:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:1.4.0_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:1.4.3_r3", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:1.4.3_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:1.44", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:1.4.6_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:1.4.0_rc2a", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:1.4.4_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:1.4.19", "cpe:/a:squirrelmail:squirrelmail:1.4.6_cvs", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:1.4.15rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.15_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.4.5_rc1", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:1.4.5", "cpe:/a:squirrelmail:squirrelmail:1.4.3"], "id": "CVE-2010-2813", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2813", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.44:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc2a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:r1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-05T14:27:43", "description": "functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preference files. NOTE: this issue exists because of an incorrect fix for CVE-2010-2813.", "cvss3": {}, "published": "2013-01-18T11:48:00", "type": "cve", "title": "CVE-2012-2124", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2023-11-07T02:10:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:-", "cpe:/o:redhat:enterprise_linux:4", "cpe:/o:redhat:enterprise_linux:5"], "id": "CVE-2012-2124", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2124", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux:4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:-:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-04T14:10:39", "description": "Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message.", "cvss3": {}, "published": "2011-07-14T23:55:00", "type": "cve", "title": "CVE-2011-2023", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2023"], "modified": "2012-02-14T04:06:00", "cpe": ["cpe:/a:squirrelmail:squirrelmail:1.2.10", "cpe:/a:squirrelmail:squirrelmail:1.4.6", "cpe:/a:squirrelmail:squirrelmail:1.1.2", "cpe:/a:squirrelmail:squirrelmail:0.1.1", "cpe:/a:squirrelmail:squirrelmail:1.4.19", "cpe:/a:squirrelmail:squirrelmail:1.4.18", "cpe:/a:squirrelmail:squirrelmail:1.4.20", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r5", "cpe:/a:squirrelmail:squirrelmail:1.2", "cpe:/a:squirrelmail:squirrelmail:1.4.3aa", "cpe:/a:squirrelmail:squirrelmail:1.1.0", "cpe:/a:squirrelmail:squirrelmail:1.4.3", "cpe:/a:squirrelmail:squirrelmail:1.4.21", "cpe:/a:squirrelmail:squirrelmail:1.4.8.4fc6", "cpe:/a:squirrelmail:squirrelmail:1.4.15", "cpe:/a:squirrelmail:squirrelmail:1.4.0", "cpe:/a:squirrelmail:squirrelmail:0.2", "cpe:/a:squirrelmail:squirrelmail:0.4pre2", "cpe:/a:squirrelmail:squirrelmail:0.5", "cpe:/a:squirrelmail:squirrelmail:1.0.6", "cpe:/a:squirrelmail:squirrelmail:1.3.0", "cpe:/a:squirrelmail:squirrelmail:1.4.3a", "cpe:/a:squirrelmail:squirrelmail:1.3.2", "cpe:/a:squirrelmail:squirrelmail:1.4.8", "cpe:/a:squirrelmail:squirrelmail:1.2.2", "cpe:/a:squirrelmail:squirrelmail:1.1.1", "cpe:/a:squirrelmail:squirrelmail:0.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.9a", "cpe:/a:squirrelmail:squirrelmail:0.5pre2", "cpe:/a:squirrelmail:squirrelmail:1.2.3", "cpe:/a:squirrelmail:squirrelmail:1.4.1", "cpe:/a:squirrelmail:squirrelmail:1.4.12", "cpe:/a:squirrelmail:squirrelmail:1.0pre2", "cpe:/a:squirrelmail:squirrelmail:1.2.7", "cpe:/a:squirrelmail:squirrelmail:0.4pre1", "cpe:/a:squirrelmail:squirrelmail:1.0.5", "cpe:/a:squirrelmail:squirrelmail:1.0.3", "cpe:/a:squirrelmail:squirrelmail:1.4.0-r1", "cpe:/a:squirrelmail:squirrelmail:1.0.4", "cpe:/a:squirrelmail:squirrelmail:1.0pre3", "cpe:/a:squirrelmail:squirrelmail:1.4.10", "cpe:/a:squirrelmail:squirrelmail:1.4.15rc1", "cpe:/a:squirrelmail:squirrelmail:0.3", "cpe:/a:squirrelmail:squirrelmail:1.2.4", "cpe:/a:squirrelmail:squirrelmail:0.2.1", "cpe:/a:squirrelmail:squirrelmail:0.4", "cpe:/a:squirrelmail:squirrelmail:0.3pre1", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r4", "cpe:/a:squirrelmail:squirrelmail:1.2.8", "cpe:/a:squirrelmail:squirrelmail:1.2.11", "cpe:/a:squirrelmail:squirrelmail:1.0.1", "cpe:/a:squirrelmail:squirrelmail:1.4.7", "cpe:/a:squirrelmail:squirrelmail:1.4.2", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r1", "cpe:/a:squirrelmail:squirrelmail:1.2.0", "cpe:/a:squirrelmail:squirrelmail:1.4.10a", "cpe:/a:squirrelmail:squirrelmail:1.2.5", "cpe:/a:squirrelmail:squirrelmail:1.4.5", "cpe:/a:squirrelmail:squirrelmail:1.4.11", "cpe:/a:squirrelmail:squirrelmail:1.2.1", "cpe:/a:squirrelmail:squirrelmail:1.3.1", "cpe:/a:squirrelmail:squirrelmail:1.4.6_cvs", "cpe:/a:squirrelmail:squirrelmail:0.1", "cpe:/a:squirrelmail:squirrelmail:1.0", "cpe:/a:squirrelmail:squirrelmail:1.4.17", "cpe:/a:squirrelmail:squirrelmail:1.4.4", "cpe:/a:squirrelmail:squirrelmail:1.2.9", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r2", "cpe:/a:squirrelmail:squirrelmail:1.4", "cpe:/a:squirrelmail:squirrelmail:1.1.3", "cpe:/a:squirrelmail:squirrelmail:1.2.6", "cpe:/a:squirrelmail:squirrelmail:1.4.13", "cpe:/a:squirrelmail:squirrelmail:1.4.2-r3", "cpe:/a:squirrelmail:squirrelmail:1.0.2", "cpe:/a:squirrelmail:squirrelmail:1.4.16", "cpe:/a:squirrelmail:squirrelmail:1.0pre1", "cpe:/a:squirrelmail:squirrelmail:1.4.9", "cpe:/a:squirrelmail:squirrelmail:0.3pre2", "cpe:/a:squirrelmail:squirrelmail:0.1.2", "cpe:/a:squirrelmail:squirrelmail:0.5pre1"], "id": "CVE-2011-2023", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2023", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.21:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.15rc1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*", "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*"]}], "ubuntucve": [{"lastseen": "2023-12-05T17:09:28", "description": "Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail\n1.4.21 and earlier allow remote attackers to hijack the authentication of\nunspecified victims via vectors involving (1) the empty trash\nimplementation and (2) the Index Order (aka options_order) page, a\ndifferent issue than CVE-2010-4555.", "cvss3": {}, "published": "2011-07-17T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2753", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555", "CVE-2011-2753"], "modified": "2011-07-17T00:00:00", "id": "UB:CVE-2011-2753", "href": "https://ubuntu.com/security/CVE-2011-2753", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-05T17:09:26", "description": "CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows\nremote attackers to modify or add preference values via a \\n (newline)\ncharacter, a different vulnerability than CVE-2010-4555.", "cvss3": {}, "published": "2011-07-17T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2752", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555", "CVE-2011-2752"], "modified": "2011-07-17T00:00:00", "id": "UB:CVE-2011-2752", "href": "https://ubuntu.com/security/CVE-2011-2752", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2023-12-03T15:23:50", "description": "Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21\nand earlier allow remote attackers to inject arbitrary web script or HTML\nvia vectors involving (1) drop-down selection lists, (2) the > (greater\nthan) character in the SquirrelSpell spellchecking plugin, and (3) errors\nassociated with the Index Order (aka options_order) page.", "cvss3": {}, "published": "2011-07-14T00:00:00", "type": "ubuntucve", "title": "CVE-2010-4555", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555"], "modified": "2011-07-14T00:00:00", "id": "UB:CVE-2010-4555", "href": "https://ubuntu.com/security/CVE-2010-4555", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-05T17:16:03", "description": "The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote\nauthenticated users to bypass firewall restrictions and use SquirrelMail as\na proxy to scan internal networks via a modified POP3 port number.", "cvss3": {}, "published": "2010-06-22T00:00:00", "type": "ubuntucve", "title": "CVE-2010-1637", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2010-06-22T00:00:00", "id": "UB:CVE-2010-1637", "href": "https://ubuntu.com/security/CVE-2010-1637", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-12-03T15:23:49", "description": "functions/page_header.php in SquirrelMail 1.4.21 and earlier does not\nprevent page rendering inside a frame in a third-party HTML document, which\nmakes it easier for remote attackers to conduct clickjacking attacks via a\ncrafted web site.", "cvss3": {}, "published": "2011-07-14T00:00:00", "type": "ubuntucve", "title": "CVE-2010-4554", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554"], "modified": "2011-07-14T00:00:00", "id": "UB:CVE-2010-4554", "href": "https://ubuntu.com/security/CVE-2010-4554", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-05T17:15:17", "description": "functions/imap_general.php in SquirrelMail before 1.4.21 does not properly\nhandle 8-bit characters in passwords, which allows remote attackers to\ncause a denial of service (disk consumption) by making many IMAP login\nattempts with different usernames, leading to the creation of many\npreferences files.\n\n#### Bugs\n\n * <https://bugzilla.redhat.com/show_bug.cgi?id=618096>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[tyhicks](<https://launchpad.net/~tyhicks>) | Note that Red Hat Security Advisory RHSA-2012:010 was incomplete (see CVE-2012-2124)\n", "cvss3": {}, "published": "2010-08-19T00:00:00", "type": "ubuntucve", "title": "CVE-2010-2813", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2010-08-19T00:00:00", "id": "UB:CVE-2010-2813", "href": "https://ubuntu.com/security/CVE-2010-2813", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-12-05T16:59:17", "description": "functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise\nLinux (RHEL) 4 and 5, does not properly handle 8-bit characters in\npasswords, which allows remote attackers to cause a denial of service (disk\nconsumption) by making many IMAP login attempts with different usernames,\nleading to the creation of many preference files. NOTE: this issue exists\nbecause of an incorrect fix for CVE-2010-2813.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[tyhicks](<https://launchpad.net/~tyhicks>) | Red Hat specific - ignoring.\n", "cvss3": {}, "published": "2013-01-18T00:00:00", "type": "ubuntucve", "title": "CVE-2012-2124", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2013-01-18T00:00:00", "id": "UB:CVE-2012-2124", "href": "https://ubuntu.com/security/CVE-2012-2124", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-12-05T17:09:30", "description": "Cross-site scripting (XSS) vulnerability in functions/mime.php in\nSquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web\nscript or HTML via a crafted STYLE element in an e-mail message.", "cvss3": {}, "published": "2011-07-14T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2023", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2023"], "modified": "2011-07-14T00:00:00", "id": "UB:CVE-2011-2023", "href": "https://ubuntu.com/security/CVE-2011-2023", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "prion": [{"lastseen": "2023-11-22T04:47:30", "description": "CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \\n (newline) character, a different vulnerability than CVE-2010-4555.", "cvss3": {}, "published": "2011-07-17T20:55:00", "type": "prion", "title": "Crlf injection", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555", "CVE-2011-2752"], "modified": "2017-08-29T01:29:00", "id": "PRION:CVE-2011-2752", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2011-2752", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2023-11-22T04:47:30", "description": "Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.", "cvss3": {}, "published": "2011-07-17T20:55:00", "type": "prion", "title": "Cross site request forgery (csrf)", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555", "CVE-2011-2753"], "modified": "2017-08-29T01:29:00", "id": "PRION:CVE-2011-2753", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2011-2753", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T05:00:36", "description": "Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index Order (aka options_order) page.", "cvss3": {}, "published": "2011-07-14T23:55:00", "type": "prion", "title": "Cross site scripting", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555"], "modified": "2017-08-17T01:33:00", "id": "PRION:CVE-2010-4555", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-4555", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T04:55:09", "description": "The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.", "cvss3": {}, "published": "2010-06-22T17:30:00", "type": "prion", "title": "Design/Logic Flaw", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2012-02-14T03:55:00", "id": "PRION:CVE-2010-1637", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-1637", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T05:00:36", "description": "functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.", "cvss3": {}, "published": "2011-07-14T23:55:00", "type": "prion", "title": "Hardcoded credentials", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554"], "modified": "2017-08-17T01:33:00", "id": "PRION:CVE-2010-4554", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-4554", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T04:57:27", "description": "functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.", "cvss3": {}, "published": "2010-08-19T18:00:00", "type": "prion", "title": "Design/Logic Flaw", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813"], "modified": "2017-08-17T01:32:00", "id": "PRION:CVE-2010-2813", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-2813", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-11-22T04:36:12", "description": "functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preference files. NOTE: this issue exists because of an incorrect fix for CVE-2010-2813.", "cvss3": {}, "published": "2013-01-18T11:48:00", "type": "prion", "title": "Design/Logic Flaw", "bulletinFamily": "NVD", "cvss2": {"baseSeverity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "source": "nvd@nist.gov", "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "type": "Primary", "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2023-02-13T04:33:00", "id": "PRION:CVE-2012-2124", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2012-2124", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-11-22T04:46:18", "description": "Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message.", "cvss3": {}, "published": "2011-07-14T23:55:00", "type": "prion", "title": "Cross site scripting", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2023"], "modified": "2012-02-14T04:06:00", "id": "PRION:CVE-2011-2023", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2011-2023", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "veracode": [{"lastseen": "2022-07-27T10:46:40", "description": "squirrelmail is vulnerable to cross-site scripting (XSS). The vulnerability exists as a remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.\n", "cvss3": {}, "published": "2020-04-10T01:06:29", "type": "veracode", "title": "Cross-site Scripting (XSS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4555"], "modified": "2022-04-19T18:32:14", "id": "VERACODE:24827", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24827/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-27T10:53:07", "description": "squirrelmail is vulnerable to information disclosure. The vulnerability exists as a flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on.\n", "cvss3": {}, "published": "2020-04-10T01:06:28", "type": "veracode", "title": "Information Disclosure", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1637"], "modified": "2022-04-19T18:24:52", "id": "VERACODE:24824", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24824/summary", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2022-07-27T10:46:43", "description": "squirrelmail is vulnerable to authorization bypass. THe vulnerability exists as SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data.\n", "cvss3": {}, "published": "2020-04-10T01:06:28", "type": "veracode", "title": "Authorization Bypass", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4554"], "modified": "2022-04-19T18:25:41", "id": "VERACODE:24826", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24826/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-27T10:25:43", "description": "squirrelmail is vulnerable to denial of service (DoS). The vulnerability exists as a flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.\n", "cvss3": {}, "published": "2020-04-10T01:06:28", "type": "veracode", "title": "Denial Of Service (DoS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813"], "modified": "2022-04-19T18:25:08", "id": "VERACODE:24825", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24825/summary", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-07-27T10:19:06", "description": "squirrelmail is vulnerable to authorization bypass. The vulnerability exists as an input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields.\n", "cvss3": {}, "published": "2020-04-10T01:06:29", "type": "veracode", "title": "Authorization Bypass", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2752"], "modified": "2022-04-19T18:16:50", "id": "VERACODE:24829", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24829/summary", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2022-07-27T10:14:39", "description": "squirrelmail is vulnerable to cross-site request forgery (CSRF). The vulnerability exists as it was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially-crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page.\n", "cvss3": {}, "published": "2020-04-10T01:06:30", "type": "veracode", "title": "Cross-site Request Fogery (CSRF)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2753"], "modified": "2022-04-19T18:22:42", "id": "VERACODE:24830", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24830/summary", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-04-18T13:58:42", "description": "SquirrelMail is vulnerable to denial of service attack.For log in attempts with 8-bit character passwords, the library creates user preference file even if the user name is invalid. Using this flaw, an attacker can exhaust memory in server by making many invalid IMAP log in attempts with different user names, leading to denial of service. The vulnerability is a result of incorrect fix for CVE-2010-2813.\n", "cvss3": {}, "published": "2019-01-15T08:52:47", "type": "veracode", "title": "Denial Of Service", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2023-02-13T07:20:37", "id": "VERACODE:10835", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-10835/summary", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-07-27T10:46:39", "description": "squirrelmail is vulnerable to cross-site scripting (XSS). The vulnerability exists as a remote attacker could use this flaw to send a specially-crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session.\n", "cvss3": {}, "published": "2020-04-10T01:06:29", "type": "veracode", "title": "Cross-site Scripting (XSS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2023"], "modified": "2022-04-19T18:21:37", "id": "VERACODE:24828", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24828/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "redhat": [{"lastseen": "2021-10-21T04:46:42", "description": "SquirrelMail is a standards-based webmail package written in PHP.\n\nThe SquirrelMail security update RHSA-2012:0103 did not, unlike the erratum\ntext stated, correct the CVE-2010-2813 issue, a flaw in the way\nSquirrelMail handled failed log in attempts. A user preference file was\ncreated when attempting to log in with a password containing an 8-bit\ncharacter, even if the username was not valid. A remote attacker could use\nthis flaw to eventually consume all hard disk space on the target\nSquirrelMail server. (CVE-2012-2124)\n\nThis update also fixes the following bugs:\n\n* Prior to this update, SquirrelMail could not decode multi-line subjects\nproperly. Consequently, the decode header internationalization option did\nnot properly handle new lines or tabs at the beginning of the lines. This\nbug has been fixed and SquirrelMail now works correctly in the described\nscenario. (BZ#241861)\n\n* Due to a bug, attachments written in HTML code on the Windows operating\nsystem were not displayed properly when accessed with SquirrelMail; the\n\"!=null\" string was trimmed to \"!ull\". This bug has been fixed and the\nattachments are now displayed correctly in such a case. (BZ#359791)\n\n* Previously, e-mail messages with a Unique Identifier (UID) larger than\n2^31 bytes were unreadable when using the squirrelmail package. With this\npatch the squirrelmail package is able to read all messages regardless of\nthe UIDs size. (BZ#450780)\n\n* Due to a bug, a PHP script did not assign the proper character set to\nrequested variables. Consequently, SquirrelMail could not display any\ne-mails. The underlying source code has been modified and now the\nsquirrelmail package assigns the correct character set. (BZ#475188)\n\n* Due to the incorrect internationalization option located at the i18n.php\nfile, the squirrelmail package could not use the GB 2312 character set. The\ni18n.php file has been fixed and the GB 2312 character set works correctly\nin the described scenario. (BZ#508686)\n\n* Previously, the preg_split() function contained a misspelled constant,\nPREG_SPLIT_NI_EMPTY, which could cause SquirrelMail to produce error\nmessages. The name of the constant has been corrected to\nPREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces error messages in\nthis scenario. (BZ#528758)\n\n* Due to Security-Enhanced Linux (SELinux) settings, sending e-mails from\nthe SquirrelMail web interface was blocked. This update adds a note to the\nSquirrelMail documentation that describes how to set the SELinux options to\nallow sending e-mails from the SquirrelMail web interface. (BZ#745380)\n\n* Previously, the squirrelmail package did not comply with the RFC 2822\nspecification about line length limits. Consequently, attachments with\nlines longer than 998 characters could not be forwarded using SquirrelMail.\nThis patch modifies the underlying source code and now SquirrelMail\ncomplies with the RFC 2822 specification as expected. (BZ#745469)\n\n* Prior to this update, the squirrelmail package required the php-common\nscript instead of the mod_php script during installation or upgrade of the\npackage, which led to a dependency error. As a result, attempting to\ninstall or upgrade the squirrelmail package failed on systems using the\nphp53 packages. With this update, the dependencies of the squirrelmail\npackage were changed and the installation or upgrade now works correctly in\nthe described scenario. (BZ#789353)\n\nAll users of SquirrelMail are advised to upgrade to this updated package,\nwhich contains backported patches to correct these issues.\n", "cvss3": {}, "published": "2013-01-08T00:00:00", "type": "redhat", "title": "(RHSA-2013:0126) Low: squirrelmail security and bug fix update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2813", "CVE-2012-2124"], "modified": "2017-09-08T08:09:30", "id": "RHSA-2013:0126", "href": "https://access.redhat.com/errata/RHSA-2013:0126", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}]}