Description
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | squirrelmail | 2:1.4.4-10 | DSA-1241-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | squirrelmail | 1.4.8-4.el4 | RHSA-2007:0022 |
| RHEL 3 | squirrelmail | 1.4.8-4.el3 | RHSA-2007:0022 |
Advisories 2
- DSA-1241-1 squirrelmail Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0022 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- ADV-2007-2732 vdb-entry
- MDKSA-2006:226 vendor-advisory
- 23195 third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- RHSA-2007:0022 vendor-advisory
- FEDORA-2007-088 vendor-advisory
- 23409 third-party-advisory
- oval:org.mitre.oval:def:9988 vdb-entry signature
- 23504 third-party-advisory
- 24284 third-party-advisory
- squirrelmail-webmail-compose-xss(30693) vdb-entry
- squirrelmail-mimeheader-xss(30695) vdb-entry
- 23322 third-party-advisory
- SUSE-SR:2007:004 vendor-advisory
- squirrelmail-magichtml-messages-xss(30694) vdb-entry
- DSA-1241 vendor-advisory
- FEDORA-2007-089 vendor-advisory
- 21414 vdb-entry
- http://docs.info.apple.com/article.html?artnum=306172
- http://sourceforge.net/project/shownotes.php?release_id=468482
- 24004 third-party-advisory
- 25159 vdb-entry
- http://squirrelmail.org/security/issue/2006-12-02
- SUSE-SR:2006:029 vendor-advisory
- https://issues.rpath.com/browse/RPL-849
- ADV-2006-4828 vdb-entry
- 23811 third-party-advisory
- 1017327 vdb-entry
- 26235 third-party-advisory