[ MDVSA-2009:222 ] squirrelmail

[dude67]

_______________________________________________________________________

Package : squirrelmail
Date : August 28, 2009
Affected: Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability has been found and corrected in squirrelmail:

All form submissions (send message, change preferences, etc.) in
SquirrelMail were previously subject to cross-site request forgery
(CSRF), wherein data could be sent to them from an offsite location,
which could allow an attacker to inject malicious content into
user preferences or possibly send emails without user consent
(CVE-2009-2964).

This update provides a solution to this vulnerability.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-2964
_______________________________________________________________________