bugtraq - Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040601211332.GB1538@lupe-christoph.de>
Date: Tue, 1 Jun 2004 23:13:32 +0200
From: lupe@...e-christoph.de (Lupe Christoph)
To: Roman Medina <roman@...labs.com>
Cc: full-disclosure@...ts.netsys.com, bugtraq@...urityfocus.com,
	vulnwatch@...nwatch.org
Subject: Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability


On Sunday, 2004-05-30 at 03:15:44 +0200, Roman Medina wrote:

> I also noticed that latest Debian stable distro ships a very old
> version of SquirrelMail, which is vulnerable to several old XSS bugs
> (in addition to the new one).

The latest Stable is itself quite old. Debian does not release very
often. But security bugs are fixed when they become known. I have not
found any bug report concerning XSS in the Debian bugs database. Please
be so kind and file bugs if you are running Debian. If not, please mail
the Debian Security Team as described in
  http://www.de.debian.org/security/faq#contact

Thank you,
Lupe Christoph
-- 
| lupe@...e-christoph.de       |           http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like   |
| covering yourself with barbecue sauce and breaking into the Charity    |
| Home for Badgers with Rabies.                            Michael Lucas |