Description
Multiple cross-site scripting (XSS) vulnerabilities in IlohaMail 0.8.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the e-mail (1) body, (2) filename, or (3) MIME type.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | ilohamail | 0.8.14-0rc3sarge1 | DSA-1010-1 |
Advisories 1
- DSA-1010-1 ilohamail - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026