Description
Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | squirrelmail | 2:1.4.9a-2 | DSA-1290-1 |
| Debian 3.1 | squirrelmail | 2:1.4.4-11 | DSA-1290-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squirrelmail | 1.4.8-4.0.1.el5 | RHSA-2007:0358 |
| RHEL 4 | squirrelmail | 1.4.8-4.0.1.el4 | RHSA-2007:0358 |
| RHEL 3 | squirrelmail | 1.4.8-6.el3 | RHSA-2007:0358 |
Advisories 2
- DSA-1290-1 squirrelmail Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0358 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- DSA-1290 vendor-advisory
- ADV-2007-2732 vdb-entry
- oval:org.mitre.oval:def:11712 vdb-entry signature
- 25200 third-party-advisory
- ADV-2007-1748 vdb-entry
- 35888 vdb-entry
- 25320 third-party-advisory
- 1018033 vdb-entry
- APPLE-SA-2007-07-31 vendor-advisory
- https://issues.rpath.com/browse/RPL-1353
- JVN#09157962 third-party-advisory
- 35887 vdb-entry
- http://www.squirrelmail.org/security/issue/2007-05-09
- MDKSA-2007:106 vendor-advisory
- 25236 third-party-advisory
- 25690 third-party-advisory
- SUSE-SR:2007:013 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=306172
- RHSA-2007:0358 vendor-advisory
- 25159 vdb-entry
- 25787 third-party-advisory
- 23910 vdb-entry
- JVNDB-2007-000398 third-party-advisory
- 26235 third-party-advisory