Skip to content
OpenAdvisories
Unscored DLA-1484-1 6 CVEs

squirrelmail - security update

Published Aug 30, 2018 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 squirrelmail 2:1.4.23~svn20120406-2+deb8u3

Vulnerabilities 6

  • Unscored —
    CVE-2018-14950

    The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.

    squirrelmail Ubuntu
  • Unscored —
    CVE-2018-14951

    The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.

    squirrelmail Ubuntu
  • Unscored —
    CVE-2018-14952

    The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.

    squirrelmail Ubuntu
  • Unscored —
    CVE-2018-14953

    The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.

    squirrelmail Ubuntu
  • Unscored —
    CVE-2018-14954

    The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.

    squirrelmail Ubuntu
  • Unscored —
    CVE-2018-14955

    The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).

    squirrelmail Ubuntu