- Issued:
- 2007-01-31
- Updated:
- 2007-01-31
RHSA-2007:0022 - Security Advisory
Synopsis
Moderate: squirrelmail security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
Topic
A new squirrelmail package that fixes security issues is now available for
Red Hat Enterprise Linux 3 and 4.
Description
SquirrelMail is a standards-based webmail package written in PHP.
Several cross-site scripting bugs were discovered in SquirrelMail. An
attacker could inject arbitrary Javascript or HTML content into
SquirrelMail pages by tricking a user into visiting a carefully crafted
URL. (CVE-2006-6142)
Users of SquirrelMail should upgrade to this erratum package, which
contains a backported patch to correct these issues.
Notes:
- After installing this update, users are advised to restart their
httpd service to ensure that the updated version functions correctly.
- config.php should NOT be modified, please modify config_local.php instead.
- Known Bug: The configuration generator may potentially produce bad
options that interfere with the operation of this application. Applying
specific config changes to config_local.php manually is recommended.
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
Affected Products
- Red Hat Enterprise Linux Server 4 x86_64
- Red Hat Enterprise Linux Server 4 ia64
- Red Hat Enterprise Linux Server 4 i386
- Red Hat Enterprise Linux Server 3 x86_64
- Red Hat Enterprise Linux Server 3 ia64
- Red Hat Enterprise Linux Server 3 i386
- Red Hat Enterprise Linux Workstation 4 x86_64
- Red Hat Enterprise Linux Workstation 4 ia64
- Red Hat Enterprise Linux Workstation 4 i386
- Red Hat Enterprise Linux Workstation 3 x86_64
- Red Hat Enterprise Linux Workstation 3 ia64
- Red Hat Enterprise Linux Workstation 3 i386
- Red Hat Enterprise Linux Desktop 4 x86_64
- Red Hat Enterprise Linux Desktop 4 i386
- Red Hat Enterprise Linux Desktop 3 x86_64
- Red Hat Enterprise Linux Desktop 3 i386
- Red Hat Enterprise Linux for IBM z Systems 4 s390x
- Red Hat Enterprise Linux for IBM z Systems 4 s390
- Red Hat Enterprise Linux for IBM z Systems 3 s390x
- Red Hat Enterprise Linux for IBM z Systems 3 s390
- Red Hat Enterprise Linux for Power, big endian 4 ppc
- Red Hat Enterprise Linux for Power, big endian 3 ppc
Fixes
- BZ - 218294 - CVE-2006-6142 Three XSS issues in SquirrelMail
CVEs
Red Hat Enterprise Linux Server 4
| SRPM | |
|---|---|
| squirrelmail-1.4.8-4.el4.src.rpm | SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3 |
| x86_64 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| ia64 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| i386 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
Red Hat Enterprise Linux Server 3
| SRPM | |
|---|---|
| x86_64 | |
| ia64 | |
| i386 |
Red Hat Enterprise Linux Workstation 4
| SRPM | |
|---|---|
| squirrelmail-1.4.8-4.el4.src.rpm | SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3 |
| x86_64 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| ia64 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| i386 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
Red Hat Enterprise Linux Workstation 3
| SRPM | |
|---|---|
| x86_64 | |
| ia64 | |
| i386 |
Red Hat Enterprise Linux Desktop 4
| SRPM | |
|---|---|
| squirrelmail-1.4.8-4.el4.src.rpm | SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3 |
| x86_64 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| i386 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
Red Hat Enterprise Linux Desktop 3
| SRPM | |
|---|---|
| x86_64 | |
| i386 |
Red Hat Enterprise Linux for IBM z Systems 4
| SRPM | |
|---|---|
| squirrelmail-1.4.8-4.el4.src.rpm | SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3 |
| s390x | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
| s390 | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
Red Hat Enterprise Linux for IBM z Systems 3
| SRPM | |
|---|---|
| s390x | |
| s390 |
Red Hat Enterprise Linux for Power, big endian 4
| SRPM | |
|---|---|
| squirrelmail-1.4.8-4.el4.src.rpm | SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3 |
| ppc | |
| squirrelmail-1.4.8-4.el4.noarch.rpm | SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07 |
Red Hat Enterprise Linux for Power, big endian 3
| SRPM | |
|---|---|
| ppc |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
