Description
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | squirrelmail | 1.4.6-5.el4 | RHSA-2006:0283 |
| RHEL 3 | squirrelmail | 1.4.6-5.el3 | RHSA-2006:0283 |
Advisories 2
- DSA-988-1 squirrelmail - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2006:0283 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- MDKSA-2006:049 vendor-advisory
- RHSA-2006:0283 vendor-advisory
- 19176 third-party-advisory
- squirrelmail-webmail-xss(24847) vdb-entry
- FEDORA-2006-133 vendor-advisory
- SUSE-SR:2006:005 vendor-advisory
- 20210 third-party-advisory
- oval:org.mitre.oval:def:10419 vdb-entry signature
- ADV-2006-0689 vdb-entry
- 18985 third-party-advisory
- 19205 third-party-advisory
- http://www.squirrelmail.org/security/issue/2006-02-01
- 19960 third-party-advisory
- 16756 vdb-entry
- 19130 third-party-advisory
- DSA-988 vendor-advisory
- 19131 third-party-advisory
- GLSA-200603-09 vendor-advisory
- 1015662 vdb-entry