Published: 11/05/2007 Updated: 11/10/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 up to and including 1.4.9a allow remote malicious users to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

Vulnerable Product	Search on Vulmon	Subscribe to Product
squirrelmail squirrelmail 1.4.3_r3
squirrelmail squirrelmail 1.4.3_rc1
squirrelmail squirrelmail 1.4.6_cvs
squirrelmail squirrelmail 1.4.6_rc1
squirrelmail squirrelmail 1.4.2
squirrelmail squirrelmail 1.4.3
squirrelmail squirrelmail 1.4.5
squirrelmail squirrelmail 1.4.6
squirrelmail squirrelmail 1.4.3a
squirrelmail squirrelmail 1.4.3aa
squirrelmail squirrelmail 1.4.7
squirrelmail squirrelmail 1.4.8
squirrelmail squirrelmail 1.4.0
squirrelmail squirrelmail 1.4.1
squirrelmail squirrelmail 1.4.4
squirrelmail squirrelmail 1.4.4_rc1
squirrelmail squirrelmail 1.4.9
squirrelmail squirrelmail 1.4.9a

It was discovered that the webmail package Squirrelmail performs insufficient sanitising inside the HTML filter, which allows the injection of arbitrary web script code during the display of HTML email messages For the oldstable distribution (sarge) this problem has been fixed in version 2:144-11 For the stable distribution (etch) this problem ...

CWE-79 http://www.squirrelmail.org/security/issue/2007-05-09 http://secunia.com/advisories/25200 http://www.debian.org/security/2007/dsa-1290 http://www.securityfocus.com/bid/23910 http://www.securitytracker.com/id?1018033 https://rhn.redhat.com/errata/RHSA-2007-0358.html http://secunia.com/advisories/25236 http://secunia.com/advisories/25320 https://issues.rpath.com/browse/RPL-1353 http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://www.mandriva.com/security/advisories?name=MDKSA-2007:106 http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.securityfocus.com/bid/25159 http://secunia.com/advisories/25690 http://secunia.com/advisories/26235 http://secunia.com/advisories/25787 http://jvn.jp/en/jp/JVN09157962/index.html http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000398.html http://www.vupen.com/english/advisories/2007/2732 http://www.vupen.com/english/advisories/2007/1748 http://osvdb.org/35887 http://osvdb.org/35888 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11712 https://nvd.nist.gov https://www.debian.org/security/./dsa-1290

CVE-2007-1262

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect