CVE-2018-8741

概要

参考情報

• openwall.com/lists/oss-security/2018/03/17/2 · Mailing List
• securitytracker.com/id/1040554 · Third Party Advisory
• gist.github.com/hannob/3c4f86863c418930ad08853c1109364e · Patch
• insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18 · Patch
• lists.debian.org/debian-lts-announce/2018/04/msg00012.html · Mailing List
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5FP5O562A4FM5TCFNEW73SS6PZONSAC
• paste.pound-python.org/show/OjSLiFTxiBrTk63jqEUu · Third Party Advisory
• debian.org/security/2018/dsa-4168 · Third Party Advisory

squirrelmail のその他の脆弱性

• CVE-2020-14933高 8.8compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendo…
• CVE-2020-14932緊急 9.8compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related t…
• CVE-2019-12970中 6.1XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the…
• CVE-2018-14955中 6.1The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).
• CVE-2018-14954中 6.1The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.