Technical Description

Fedora has released updated packages to address a vulnerability identified in SquirrelMail. This flaw could be exploited by attackers to include or disclose the contents of local files with the privileges of the web server. For additional information, see : VUPEN/ADV-2006-2101

Affected Products

Fedora Core 4
Fedora Core 5

Solution

Upgrade the affected packages :
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/
6991c73223c32d99e329ef0dfeca62a5697e9882 SRPMS/squirrelmail-1.4.6-7.fc4.src.rpm
6991c73223c32d99e329ef0dfeca62a5697e9882 noarch/squirrelmail-1.4.6-7.fc4.src.rpm
76ea21f3c5298556dffc841eb047cabfd21620d3 ppc/squirrelmail-1.4.6-7.fc4.noarch.rpm
76ea21f3c5298556dffc841eb047cabfd21620d3 x86_64/squirrelmail-1.4.6-7.fc4.noarch.rpm
76ea21f3c5298556dffc841eb047cabfd21620d3 i386/squirrelmail-1.4.6-7.fc4.noarch.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/
9b33ed059ae0786448d8595b7789f0d0c8d02bf9 SRPMS/squirrelmail-1.4.6-7.fc5.src.rpm
9b33ed059ae0786448d8595b7789f0d0c8d02bf9 noarch/squirrelmail-1.4.6-7.fc5.src.rpm
e444c8eae171aa7f6d7bddf0022ad211217e9763 ppc/squirrelmail-1.4.6-7.fc5.noarch.rpm
e444c8eae171aa7f6d7bddf0022ad211217e9763 x86_64/squirrelmail-1.4.6-7.fc5.noarch.rpm
e444c8eae171aa7f6d7bddf0022ad211217e9763 i386/squirrelmail-1.4.6-7.fc5.noarch.rpm

References

http://www.vupen.com/english/advisories/2006/2223
https://www.redhat.com/archives/fedora-package-announce/2006-June/msg00050.html
https://www.redhat.com/archives/fedora-package-announce/2006-June/msg00054.html

ChangeLog

2006-06-08 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.