Updated squirrelmail to 1.4.6

This release is very important, and we strongly advise everybody to
update to the latest release.

Security Update
===============
This version contains a number of security updates that were brought
to our attention via a number of sources.

- In webmail.php, the right_frame parameter was not properly sanitized
  to deal with very lenient browsers, which allowed for cross site
  scripting or frame replacing. [CVE-2006-0188]

- In the MagicHTML function, some very obscure constructs were
  discovered to be exploitable: 'u\rl' was interpreted as 'url' (privacy
  concern), and comments could be inside keywords (allows for cross site
  scripting). Both only affect Internet Explorer users. Found by Martijn
  Brinkers and Scott Hughes. [CVE-2006-0195]

- The function sqimap_mailbox_select did not strip newlines from the
  mailbox parameter, and thereby allowed for IMAP command injection.
  Found by Vicente Aguilera. [CVE-2006-0377]

1 files changed, 18 insertions, 1 deletions

diff --git a/mail/squirrelmail/PLIST b/mail/squirrelmail/PLIST
index 874e9ed4642..9d9f341971f 100644
--- a/mail/squirrelmail/PLIST
+++ b/mail/squirrelmail/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.16 2005/07/18 07:04:27 martti Exp $
+@comment $NetBSD: PLIST,v 1.17 2006/02/27 07:12:13 martti Exp $
 share/examples/squirrelmail/squirrelmail.conf
 share/squirrelmail/AUTHORS
 share/squirrelmail/COPYING
@@ -13,6 +13,7 @@ share/squirrelmail/class/deliver/Deliver_SMTP.class.php
 share/squirrelmail/class/deliver/Deliver_SendMail.class.php
 share/squirrelmail/class/deliver/index.php
 share/squirrelmail/class/helper/VCard.class.php
+share/squirrelmail/class/helper/index.php
 share/squirrelmail/class/html.class.php
 share/squirrelmail/class/index.php
 share/squirrelmail/class/mime.class.php
@@ -63,12 +64,14 @@ share/squirrelmail/doc/ReleaseNotes/1.4/Notes-1.4.2.txt
 share/squirrelmail/doc/ReleaseNotes/1.4/Notes-1.4.3.txt
 share/squirrelmail/doc/ReleaseNotes/1.4/Notes-1.4.3a.txt
 share/squirrelmail/doc/ReleaseNotes/1.4/Notes-1.4.4.txt
+share/squirrelmail/doc/ReleaseNotes/1.4/Notes-1.4.5.txt
 share/squirrelmail/doc/authentication.txt
 share/squirrelmail/doc/db-backend.txt
 share/squirrelmail/doc/ie_ssl.txt
 share/squirrelmail/doc/index.html
 share/squirrelmail/doc/presets.txt
 share/squirrelmail/doc/russian_apache.txt
+share/squirrelmail/doc/security.txt
 share/squirrelmail/doc/themes.txt
 share/squirrelmail/doc/translating.txt
 share/squirrelmail/doc/translating_help.txt
@@ -92,6 +95,7 @@ share/squirrelmail/functions/decode/cp1257.php
 share/squirrelmail/functions/decode/cp1258.php
 share/squirrelmail/functions/decode/cp855.php
 share/squirrelmail/functions/decode/cp866.php
+share/squirrelmail/functions/decode/index.php
 share/squirrelmail/functions/decode/iso_8859_1.php
 share/squirrelmail/functions/decode/iso_8859_10.php
 share/squirrelmail/functions/decode/iso_8859_11.php
@@ -118,6 +122,7 @@ share/squirrelmail/functions/display_messages.php
 share/squirrelmail/functions/encode/cp1251.php
 share/squirrelmail/functions/encode/cp1255.php
 share/squirrelmail/functions/encode/cp1256.php
+share/squirrelmail/functions/encode/index.php
 share/squirrelmail/functions/encode/iso_8859_1.php
 share/squirrelmail/functions/encode/iso_8859_15.php
 share/squirrelmail/functions/encode/iso_8859_2.php
@@ -188,6 +193,7 @@ share/squirrelmail/locale/index.php
 share/squirrelmail/locale/timezones.cfg
 share/squirrelmail/plugins/README.plugins
 share/squirrelmail/plugins/abook_take/README
+share/squirrelmail/plugins/abook_take/index.php
 share/squirrelmail/plugins/abook_take/setup.php
 share/squirrelmail/plugins/abook_take/take.php
 share/squirrelmail/plugins/administrator/INSTALL
@@ -222,12 +228,14 @@ share/squirrelmail/plugins/filters/bulkquery/README
 share/squirrelmail/plugins/filters/bulkquery/bq.in
 share/squirrelmail/plugins/filters/bulkquery/bq.out
 share/squirrelmail/plugins/filters/bulkquery/bulkquery.c
+share/squirrelmail/plugins/filters/bulkquery/index.php
 share/squirrelmail/plugins/filters/filters.php
 share/squirrelmail/plugins/filters/index.php
 share/squirrelmail/plugins/filters/options.php
 share/squirrelmail/plugins/filters/setup.php
 share/squirrelmail/plugins/filters/spamoptions.php
 share/squirrelmail/plugins/fortune/INSTALL
+share/squirrelmail/plugins/fortune/index.php
 share/squirrelmail/plugins/fortune/setup.php
 share/squirrelmail/plugins/index.php
 share/squirrelmail/plugins/info/README
@@ -247,6 +255,7 @@ share/squirrelmail/plugins/mail_fetch/index.php
 share/squirrelmail/plugins/mail_fetch/options.php
 share/squirrelmail/plugins/mail_fetch/setup.php
 share/squirrelmail/plugins/make_archive.pl
+share/squirrelmail/plugins/message_details/index.php
 share/squirrelmail/plugins/message_details/message_details_bottom.php
 share/squirrelmail/plugins/message_details/message_details_main.php
 share/squirrelmail/plugins/message_details/message_details_top.php
@@ -261,6 +270,7 @@ share/squirrelmail/plugins/newmail/sounds/FanFair.wav
 share/squirrelmail/plugins/newmail/sounds/Friends.wav
 share/squirrelmail/plugins/newmail/sounds/MontyPython.wav
 share/squirrelmail/plugins/newmail/sounds/Notify.wav
+share/squirrelmail/plugins/newmail/sounds/index.php
 share/squirrelmail/plugins/newmail/testsound.php
 share/squirrelmail/plugins/sent_subfolders/index.php
 share/squirrelmail/plugins/sent_subfolders/setup.php
@@ -357,11 +367,13 @@ share/squirrelmail/themes/alien_glow.php
 share/squirrelmail/themes/black_bean_burrito_theme.php
 share/squirrelmail/themes/blue_grey_theme.php
 share/squirrelmail/themes/bluesnews_theme.php
+share/squirrelmail/themes/bluesome.php
 share/squirrelmail/themes/bluesteel_theme.php
 share/squirrelmail/themes/christmas.php
 share/squirrelmail/themes/css/comic-sans-08.css
 share/squirrelmail/themes/css/comic-sans-10.css
 share/squirrelmail/themes/css/comic-sans-12.css
+share/squirrelmail/themes/css/index.php
 share/squirrelmail/themes/css/sans-08.css
 share/squirrelmail/themes/css/sans-10.css
 share/squirrelmail/themes/css/sans-12.css
@@ -402,10 +414,15 @@ share/squirrelmail/themes/sandstorm_theme.php
 share/squirrelmail/themes/seaspray_theme.php
 share/squirrelmail/themes/servery_theme.php
 share/squirrelmail/themes/shades_of_grey.php
+share/squirrelmail/themes/silver_steel_theme.php
+share/squirrelmail/themes/simple_green2.php
+share/squirrelmail/themes/simple_green_theme.php
+share/squirrelmail/themes/simple_purple.php
 share/squirrelmail/themes/slashdot_theme.php
 share/squirrelmail/themes/spice_of_life.php
 share/squirrelmail/themes/spice_of_life_dark.php
 share/squirrelmail/themes/spice_of_life_lite.php
+share/squirrelmail/themes/wood_theme.php
 @dirrm share/squirrelmail/themes/css
 @dirrm share/squirrelmail/themes
 @dirrm share/squirrelmail/src