[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090512162306.29690e19@redhat.com>
Date: Tue, 12 May 2009 16:23:06 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: hanno@...eck.de, Steven Christey <coley@...us.mitre.org>
Subject: Re: CVE request: Squirrelmail < 1.4.18 XSS, session
fixation, server-side code execution
Hi Hanno!
On Tue, 12 May 2009 09:43:36 +0200 Hanno Böck <hanno@...eck.de> wrote:
> From squirrelmail.org:
> The SquirrelMail Team is pleased to announce the release of
> SquirrelMail version 1.4.18. The most notable changes for this
> version are several security fixes, including a couple XSS exploits,
> a session fixation issue, and an obscure but dangerous server-side
> code execution hole.
Was this meant as CVE request? Upstream changelog does mention CVEs
for the issues, as well as upstream SVN commits and security page:
http://www.squirrelmail.org/security/
HTH
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
