PT-2006-1272 · Microsoft+2 · Internet Explorer+2

Martijn Brinkers + 1 · Published 2006-02-24 · Updated 2017-10-11 · CVE-2006-0195

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.4.0 through 1.4.5

Description The issue is related to an interpretation conflict in the MagicHTML filter, allowing remote attackers to conduct cross-site scripting (XSS) attacks. This can be achieved via style sheet specifiers with invalid comments, such as "/" and "/", or a newline in a "url" specifier. Certain web browsers, including Internet Explorer, process these specifiers in a way that enables the attack.

Recommendations For SquirrelMail versions 1.4.0 through 1.4.5, update to a version that fixes the MagicHTML filter interpretation conflict to prevent cross-site scripting attacks.

Fix

Related Identifiers

CVE-2006-0195

DSA-988-1

RHSA-2006:0283

RHSA-2006_0283

Affected Products

Internet Explorer

Red Hat

Squirrelmail

References · 26

• http://redhat.com/support/errata/RHSA-2006-0283.html · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2006-March/msg00004.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:049 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200603-09.xml · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_05_sr.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0195 · Security Note
• http://debian.org/security/2006/dsa-988 · Vendor Advisory
• http://secunia.com/advisories/18985 · Vendor Advisory
• http://secunia.com/advisories/19131 · Note
• http://secunia.com/advisories/19205 · Note
• http://squirrelmail.org/security/issue/2006-02-10 · Note
• http://securityfocus.com/bid/16756 · Note
• https://access.redhat.com/security/cve/CVE-2006-0188 · Note
• https://access.redhat.com/security/cve/CVE-2006-0377 · Note