From Red Hat Security Advisory 2009:0057 :

An updated squirrelmail package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.

The Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory introduced a session handling flaw. Users who logged back into SquirrelMail without restarting their web browsers were assigned fixed session identifiers. A remote attacker could make use of that flaw to hijack user sessions. (CVE-2009-0030)

SquirrelMail users should upgrade to this updated package, which contains a patch to correct this issue. As well, all users who used affected versions of SquirrelMail should review their preferences.

RHSA-2009:0010 アドバイザリで提供される Red Hat SquirrelMail パッケージでは、セッション処理の欠陥が導入されました。Web ブラウザを再起動することなく SquirrelMail に再ログインしたユーザーに、固定のセッション識別子が割り当てられました。リモートの攻撃者がこの欠陥を利用して、ユーザーセッションをハイジャックすることが可能です。（CVE-2009-0030）

The Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory introduced a session handling flaw. Users who logged back into SquirrelMail without restarting their web browsers were assigned fixed session identifiers. A remote attacker could make use of that flaw to hijack user sessions. (CVE-2009-0030)

This update of squirrelmail corrects a problem introduced by a patch for CVE-2008-3663 that caused cookies to be static. (CVE-2009-0030)

An updated squirrelmail package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.

The Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory introduced a session handling flaw. Users who logged back into SquirrelMail without restarting their web browsers were assigned fixed session identifiers. A remote attacker could make use of that flaw to hijack user sessions. (CVE-2009-0030)

SquirrelMail users should upgrade to this updated package, which contains a patch to correct this issue. As well, all users who used affected versions of SquirrelMail should review their preferences.

Red Hat セキュリティアドバイザリ 2009:0057 から：

セキュリティ問題を修正する更新済みの squirrelmail パッケージが、Red Hat Enterprise Linux 3、4 および 5 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新に重大なセキュリティインパクトがあると評価しています。

SquirrelMail は PHP で書かれた、構成が簡単な標準ベースの Webmail パッケージです。このパッケージには、IMAP および SMTP プロトコルに対する埋め込み式 PHP のサポート、およびピュアな HTML 4.0 ページレンダリング（JavaScript 不要）が含まれ、最高のブラウザ互換性、優れた MIME サポート、アドレス帳、およびフォルダー操作を実現します。

RHSA-2009:0010 アドバイザリで提供される Red Hat SquirrelMail パッケージでは、セッション処理の欠陥が導入されました。Web ブラウザを再起動することなく SquirrelMail に再ログインしたユーザーに、固定のセッション識別子が割り当てられました。リモートの攻撃者がこの欠陥を利用して、ユーザーセッションをハイジャックすることが可能です。(CVE-2009-0030)

SquirrelMail ユーザーは、パッチが含まれるこの更新済みパッケージへアップグレードし、この問題を修正する必要があります。また、影響を受ける SquirrelMail のバージョンを使用した全ユーザーは設定を確認する必要があります。

RHSA-2009:0010 公告提供的 Red Hat SquirrelMail 程序包引入会话处理缺陷。固定会话标识符分配到已重新登录 SquirrelMail 但未重新启动其 Web 浏览器的用户。远程攻击者可利用此缺陷劫持用户会话。(CVE-2009-0030)

来自 Red Hat 安全公告 2009:0057：

更新后的 squirrelmail 程序包修复了一个安全问题，现在可用于 Red Hat Enterprise Linux 3、4 和 5。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

SquirrelMail 是以 PHP 编写的 webmail 程序包，配置简便，以标准为基础。它内置对 IMAP 和 SMTP 协议的 PHP 支持，并包括纯 HTML 4.0 页渲染（无需 JavaScript），可实现最大的浏览器兼容性、强大的 MIME 支持、通讯簿及文件夹操作。

RHSA-2009:0010 公告提供的 Red Hat SquirrelMail 程序包引入会话处理缺陷。固定会话标识符分配到已重新登录 SquirrelMail 但未重新启动其 Web 浏览器的用户。远程攻击者可利用此缺陷劫持用户会话。(CVE-2009-0030)

SquirrelMail 用户应升级此更新后的程序包，其中包含用于修正此问题的修补程序。此外，使用受影响的 SquirrelMail 版本的所有用户应检查其首选项。

This update brings the Mozilla Firefox 3.5 webbrowser to version 3.5.3, the Mozilla XULRunner 1.9.0 engine to the 1.9.0.14 stable release, and the Mozilla XULRunner 1.9.1 engine to the 1.9.1.3 stable release.

It also fixes various security issues: MFSA 2009-47 / CVE-2009-3069 / CVE-2009-3070 / CVE-2009-3071 / CVE-2009-3072 / CVE-2009-3073 / CVE-2009-30 / CVE-2009-3075: Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2009-48 / CVE-2009-3076: Mozilla security researcher Jesse Rudermanreported that when security modules were added or removed via pkcs11.addmodule or pkcs11.deletemodule, the resulting dialog was not sufficiently informative. Without sufficient warning, an attacker could entice a victim to install a malicious PKCS11 module and affect the cryptographic integrity of the victim's browser. Security researcher Dan Kaminsky reported that this issue had not been fixed in Firefox 3.0 and that under certain circumstances pkcs11 modules could be installed from a remote location. Firefox 3.5 releases are not affected.

MFSA 2009-49 / CVE-2009-3077: An anonymous security researcher, via TippingPoint's Zero Day Initiative, reported that the columns of a XUL tree element could be manipulated in a particular way which would leave a pointer owned by the column pointing to freed memory. An attacker could potentially use this vulnerability to crash a victim's browser and run arbitrary code on the victim's computer.

MFSA 2009-50 / CVE-2009-3078: Security researcher Juan Pablo Lopez Yacubian reported that the default Windows font used to render the locationbar and other text fields was improperly displaying certain Unicode characters with tall line-height. In such cases the tall line-height would cause the rest of the text in the input field to be scrolled vertically out of view. An attacker could use this vulnerability to prevent a user from seeing the URL of a malicious site. Corrie Sloot also independently reported this issue to Mozilla.

MFSA 2009-51 / CVE-2009-3079: Mozilla security researcher moz_bug_r_a4 reported that the BrowserFeedWriter could be leveraged to run JavaScript code from web content with elevated privileges. Using this vulnerability, an attacker could construct an object containing malicious JavaScript and cause the FeedWriter to process the object, running the malicious code with chrome privileges. Thunderbird does not support the BrowserFeedWriter object and is not vulnerable in its default configuration. Thunderbird might be vulnerable if the user has installed any add-on which adds a similarly implemented feature and then enables JavaScript in mail messages. This is not the default setting and we strongly discourage users from running JavaScript in mail.

來自 Red Hat 安全性公告 2009:0057：

現已提供適用於 Red Hat Enterprise Linux 3、4 和 5 的更新版 squirrelmail 套件，可修正一個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有重要安全性影響。

SquirrelMail 是以 PHP 撰寫且易於設定的標準式 Webmail 套件。其中包含適用於 IMAP、SMTP 通訊協定，以及純 HTML 4.0 頁面轉譯 (不需要 JavaScript) 的內建 PHP 支援，以確保達到最大限度的瀏覽器相容性；此外還提供強式 MIME 支援、通訊錄和資料夾操控功能。

RHSA-2009:0010 公告提供的 Red Hat SquirrelMail 套件引入了一個工作階段處理瑕疵。登入回 SquirrelMail 而未重新啟動其網頁瀏覽器的使用者獲指派固定工作階段識別碼。遠端攻擊者可利用該瑕疵劫持使用者工作階段。(CVE-2009-0030)

SquirrelMail 使用者應升級至此更新版套件，其中包含一個可更正此問題的修補程式。另外，使用受影響 SquirrelMail 版本的所有使用者也應檢閱其偏好設定。

RHSA-2009:0010 公告提供的 Red Hat SquirrelMail 套件引入了一個工作階段處理瑕疵。登入回 SquirrelMail 而未重新啟動其網頁瀏覽器的使用者獲指派固定工作階段識別碼。遠端攻擊者可利用該瑕疵劫持使用者工作階段。(CVE-2009-0030)

ID	名稱	產品	系列	已發布	已更新	嚴重性
67794	Oracle Linux 3 / 4 / 5 : squirrelmail (ELSA-2009-0057)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
60522	Scientific Linux セキュリティ更新：SL3.x、SL4.x、SL5.x i386/x86_64 の squirrelmail	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
60522	Scientific Linux Security Update : squirrelmail on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
35598	openSUSE 10 Security Update : squirrelmail (squirrelmail-5978)	Nessus	SuSE Local Security Checks	2009/2/5	2021/1/14	medium
35429	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:0057)	Nessus	Red Hat Local Security Checks	2009/1/20	2021/1/14	medium
67794	Oracle Linux 3/4/5：squirrelmail（ELSA-2009-0057）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
60522	Scientific Linux 安全更新：SL3.x、SL4.x、SL5.x i386/x86_64 中的 squirrelmail	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67794	Oracle Linux 3 / 4 / 5：squirrelmail (ELSA-2009-0057)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
35424	CentOS 3 / 4 / 5 : squirrelmail (CESA-2009:0057)	Nessus	CentOS Local Security Checks	2009/1/20	2021/1/4	medium
42189	SuSE Security Update: Security update for Mozilla Firefox (firefox35upgrade-6562)	Nessus	SuSE Local Security Checks	2009/10/20	2021/1/14	critical
67794	Oracle Linux 3 / 4 / 5 : squirrelmail (ELSA-2009-0057)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
60522	Scientific Linux 安全性更新：SL3.x、SL4.x、SL5.x i386/x86_64 上的 squirrelmail	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium