Description
Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | squirrelmail | 1.4.3a-7.EL3 | RHSA-2004:654 |
Advisories 1
- RHSA-2004:654 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- APPLE-SA-2005-01-25 vendor-advisory
- GLSA-200411-25 vendor-advisory
- squirrelmail-mime-xss(18031) vdb-entry
- http://voxel.dl.sourceforge.net/sourceforge/squirrelmail/sm143a-xss.diff
- http://www.squirrelmail.org/
- APPLE-SA-2005-03-21 vendor-advisory
- oval:org.mitre.oval:def:9592 vdb-entry signature
- CLA-2004:905 vendor-advisory
- 20041110 [SquirrelMail Security Advisory] Cross Site Scripting in encoded text mailing-list