diff options
author | martti <martti> | 2006-02-27 07:12:13 +0000 |
---|---|---|
committer | martti <martti> | 2006-02-27 07:12:13 +0000 |
commit | 1cc0467f0d3f02a2c670f2ed0a6a20e1ae727afb (patch) | |
tree | 6dc6f10d3fd5117f905c07cde5becb650ce46816 /chat/goofey | |
parent | 74485f1ffe36769109fc7224c8ae0529277bd07f (diff) | |
download | pkgsrc-1cc0467f0d3f02a2c670f2ed0a6a20e1ae727afb.tar.gz |
Updated squirrelmail to 1.4.6
This release is very important, and we strongly advise everybody to
update to the latest release.
Security Update
===============
This version contains a number of security updates that were brought
to our attention via a number of sources.
- In webmail.php, the right_frame parameter was not properly sanitized
to deal with very lenient browsers, which allowed for cross site
scripting or frame replacing. [CVE-2006-0188]
- In the MagicHTML function, some very obscure constructs were
discovered to be exploitable: 'u\rl' was interpreted as 'url' (privacy
concern), and comments could be inside keywords (allows for cross site
scripting). Both only affect Internet Explorer users. Found by Martijn
Brinkers and Scott Hughes. [CVE-2006-0195]
- The function sqimap_mailbox_select did not strip newlines from the
mailbox parameter, and thereby allowed for IMAP command injection.
Found by Vicente Aguilera. [CVE-2006-0377]
Diffstat (limited to 'chat/goofey')
0 files changed, 0 insertions, 0 deletions