Description
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | squirrelmail | 1.2.6-1.1 | DSA-191 |
Advisories 1
- DSA-191 squirrelmail - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-191 vendor-advisory
- 7019 vdb-entry
- squirrelmail-striptags-phpself-xss(10634) vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=167471
- 8220 third-party-advisory
- RHSA-2003:042 vendor-advisory