openSUSE 10 Security Update : squirrelmail (squirrelmail-5835)

Insufficient input checks could allow remote attackers to conduct a cross site scripting XSS attack CVE-2008-2379. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update squirrelmail-5835. The text...

CVE-2008-2379

Cross-site scripting XSS vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message...

squirrelmail -- Cross site scripting vulnerability

Squirrelmail team reports: An issue was fixed that allowed an attacker to send specially- crafted hyperlinks in a message that could execute cross-site scripting XSS when the user viewed the message in SquirrelMail...

openSUSE 10 Security Update : squirrelmail (squirrelmail-5792)

Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. CVE-2008-3663 The previous update for the problem above contained a typo which broke squirrelmail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

openSUSE 10 Security Update : squirrelmail (squirrelmail-5778)

Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. CVE-2008-3663 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

Fedora 8 : squirrelmail-1.4.16-1.fc8 (2008-9071)

update to 1.4.16 fixes CVE-2008-3663 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

[SECURITY] Fedora 8 Update: squirrelmail-1.4.16-1.fc8

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

Fedora 9 : squirrelmail-1.4.16-1.fc9 (2008-8559)

rebase to 1.4.16 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] Fedora 9 Update: squirrelmail-1.4.16-1.fc9

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

SquirrelMail不安全COOKE泄漏漏洞

BUGTRAQ ID: 31321 CVE ID：CVE-2008-3663 CNCVE ID：CNCVE-20083663 SquirrelMail是一款基于PHP的WEB邮件服务程序。 SquirrelMail不安全处理COOKIE数据，远程攻击者可以利用漏洞获得敏感信息，窃取COOKIE验证敏感条文，进行会话劫持攻击。 当配置WEB应用程序只使用SSL时如转向所有HTTP请求到HTTPS，用户可以不能通过嗅探来进行截获。 要因此变的更安全，需要设置会话COOKIE标有安全标记，否则如果目标用户浏览器在同一域上只进行单个HTTP请求，COOKIE会通过HTTP传送。...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

Design/Logic Flaw

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3663

CVE-2008-3663 summary (from provided docs): SquirrelMail prior to the patch release had a session cookie that was not marked Secure during HTTPS, potentially allowing cookie exposure to remote attackers via HTTP requests. The linked advisories reference SquirrelMail 1.4.15 and note that updates/p...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

Gentoo Security Advisory GLSA 200603-09 (squirrelmail)

The remote host is missing updates announced in advisory GLSA 200603-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200501-39 (SquirrelMail)

The remote host is missing updates announced in advisory GLSA 200501-39. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200411-25 (SquirrelMail)

The remote host is missing updates announced in advisory GLSA 200411-25. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200708-08 (squirrelmail)

The remote host is missing updates announced in advisory GLSA 200708-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200406-08 (Squirrelmail)

The remote host is missing updates announced in advisory GLSA 200406-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...