squirrelmail vulnérable

["Schmitt georges" <jo@engees.u-strasbg.fr>]

Bonjour à tous,

quelqu'un a plus d'info sur cette vulnérabilité et la mise à jour du paquet
deb sur woody ?

Georges S.

> Product: Squirrel Mail 1.2.7 - released June 21, 2002 (tested, others
> possibly vulnerable)
> Vendor: Squirrel Mail - Web: www.squirrelmail.org
> Problem: Cross Site Scripting
> Severity: Moderate
> Operating System(s): Tested against Red Hat 7.3, all others vulnerable
> if they are using this version of Squirrel.

Mr KonQuesT,
  All the listed exploits have been fixed in the recently released 1.2.8
version of SquirrelMail. These fixes have also been applied to the
current development and stable CVS, 1.3.2 and 1.2.9 respectively