CVE-2004-0519

NameCVE-2004-0519
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-535
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squirrelmail (PTS)wheezy2:1.4.23~svn20120406-2fixed
wheezy (security)2:1.4.23~svn20120406-2+deb7u1fixed
jessie (security), jessie2:1.4.23~svn20120406-2+deb8u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squirrelmailsource(unstable)2:1.4.3a-0.1medium
squirrelmailsourcewoody1:1.2.6-1.4mediumDSA-535

Search for package or bug name: Reporting problems