National Cyber-Alert System

Vulnerability Summary for CVE-2006-6142

Overview

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 21414

Hyperlink:http://www.securityfocus.com/bid/21414

External Source: VUPEN

Name: ADV-2006-4828

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2006/4828

External Source: CONFIRM

Name: http://squirrelmail.org/security/issue/2006-12-02

Hyperlink:http://squirrelmail.org/security/issue/2006-12-02

External Source: CONFIRM

Name: http://sourceforge.net/project/shownotes.php?release_id=468482

Hyperlink:http://sourceforge.net/project/shownotes.php?release_id=468482

External Source: SECTRACK

Name: 1017327

Hyperlink:http://securitytracker.com/id?1017327

External Source: SECUNIA

Name: 23195

Hyperlink:http://secunia.com/advisories/23195

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-849

Hyperlink:https://issues.rpath.com/browse/RPL-849

External Source: XF

Name: squirrelmail-mimeheader-xss(30695)

Hyperlink:http://xforce.iss.net/xforce/xfdb/30695

External Source: XF

Name: squirrelmail-magichtml-messages-xss(30694)

Hyperlink:http://xforce.iss.net/xforce/xfdb/30694

External Source: XF

Name: squirrelmail-webmail-compose-xss(30693)

Hyperlink:http://xforce.iss.net/xforce/xfdb/30693

External Source: BID

Name: 25159

Hyperlink:http://www.securityfocus.com/bid/25159

External Source: REDHAT

Name: RHSA-2007:0022

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0022.html

External Source: SUSE

Name: SUSE-SR:2007:004

Hyperlink:http://www.novell.com/linux/security/advisories/2007_4_sr.html

External Source: SUSE

Name: SUSE-SR:2006:029

Hyperlink:http://www.novell.com/linux/security/advisories/2006_29_sr.html

External Source: MANDRIVA

Name: MDKSA-2006:226

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:226

External Source: VUPEN

Name: ADV-2007-2732

Hyperlink:http://www.frsirt.com/english/advisories/2007/2732

External Source: DEBIAN

Name: DSA-1241

Hyperlink:http://www.debian.org/security/2006/dsa-1241

External Source: SECUNIA

Name: 26235

Hyperlink:http://secunia.com/advisories/26235

External Source: SECUNIA

Name: 24284

Hyperlink:http://secunia.com/advisories/24284

External Source: SECUNIA

Name: 24004

Hyperlink:http://secunia.com/advisories/24004

External Source: SECUNIA

Name: 23811

Hyperlink:http://secunia.com/advisories/23811

External Source: SECUNIA

Name: 23504

Hyperlink:http://secunia.com/advisories/23504

External Source: SECUNIA

Name: 23409

Hyperlink:http://secunia.com/advisories/23409

External Source: SECUNIA

Name: 23322

Hyperlink:http://secunia.com/advisories/23322

External Source: APPLE

Name: APPLE-SA-2007-07-31

Hyperlink:http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

External Source: MANDRIVA

Name: MDKSA-2006:226

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:226

External Source: FEDORA

Name: FEDORA-2007-089

Hyperlink:http://fedoranews.org/cms/node/2439

External Source: FEDORA

Name: FEDORA-2007-088

Hyperlink:http://fedoranews.org/cms/node/2438

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=306172

Hyperlink:http://docs.info.apple.com/article.html?artnum=306172

External Source: SGI

Name: 20070201-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc