squirrelmail: CVE-2018-14950 CVE-2018-14951 CVE-2018-14952 CVE-2018-14953 CVE-2018-14954 CVE-2018-14955

Debian Bug report logs - #905023
squirrelmail: CVE-2018-14950 CVE-2018-14951 CVE-2018-14952 CVE-2018-14953 CVE-2018-14954 CVE-2018-14955

version graph

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Mon, 30 Jul 2018 18:39:04 UTC

Severity: important

Tags: fixed-upstream, security, upstream

Found in version squirrelmail/2:1.4.23~svn20120406-2

Forwarded to https://sourceforge.net/p/squirrelmail/bugs/2831/

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, Jeroen van Wolffelaar <jeroen@wolffelaar.nl>:
Bug#905023; Package src:squirrelmail. (Mon, 30 Jul 2018 18:39:06 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, Jeroen van Wolffelaar <jeroen@wolffelaar.nl>. (Mon, 30 Jul 2018 18:39:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: squirrelmail: Multiple persistent XSS vulnerabilities in message display
Date: Mon, 30 Jul 2018 20:34:19 +0200
Source: squirrelmail
Version: 2:1.4.23~svn20120406-2
Severity: important
Tags: security upstream

Hi

See [1] for the report on oss-security. It is reported upstream at
[2].

 [1] http://www.openwall.com/lists/oss-security/2018/07/26/2
 [2] https://sourceforge.net/p/squirrelmail/bugs/2831/

Regards,
Salvatore



Set Bug forwarded-to-address to 'https://sourceforge.net/p/squirrelmail/bugs/2831/'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Mon, 30 Jul 2018 18:45:02 GMT) (full text, mbox, link).


Changed Bug title to 'squirrelmail: CVE-2018-14950 CVE-2018-14951 CVE-2018-14952 CVE-2018-14953 CVE-2018-14954 CVE-2018-14955' from 'squirrelmail: Multiple persistent XSS vulnerabilities in message display'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 05 Aug 2018 20:21:08 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Jeroen van Wolffelaar <jeroen@wolffelaar.nl>:
Bug#905023; Package src:squirrelmail. (Sat, 25 Aug 2018 17:24:04 GMT) (full text, mbox, link).


Acknowledgement sent to Abhijith PA <abhijith@disroot.org>:
Extra info received and forwarded to list. Copy sent to Jeroen van Wolffelaar <jeroen@wolffelaar.nl>. (Sat, 25 Aug 2018 17:24:04 GMT) (full text, mbox, link).


Message #14 received at 905023@bugs.debian.org (full text, mbox, reply):

From: Abhijith PA <abhijith@disroot.org>
To: 893202@bugs.debian.org, carnil@debian.org
Cc: 905023@bugs.debian.org
Subject: quirrelmail 2:1.4.23~svn20120406-2+deb8u2 Lintian run failed (policy violation)
Date: Sat, 25 Aug 2018 22:50:46 +0530
Hello.

I was preparing build for the latest CVEs of squirrelmail (#905023) and
found out the latest version in jessie have a grave lintian warning -
"squirrelmail source: license-problem-non-free-RFC
functions/decode/koi8_u.php". Have you noticed it :)


Thanks in advance
Abhijith PA



Added tag(s) fixed-upstream. Request was from debian-bts-link@lists.debian.org to control@bugs.debian.org. (Thu, 28 Feb 2019 18:30:15 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:03:47 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.