CVE-2006-6142
Summary
| CVE | CVE-2006-6142 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2006-12-05 11:28:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." |
Risk And Classification
Primary CVSS: v2.0 6.8 from [email protected]
AV:N/AC:M/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Squirrelmail | Squirrelmail | 1.4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3aa | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3_r3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.4_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.5 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6_cvs | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.7 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4_rc1 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat update for squirrelmail - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SUSE Update for Multiple Packages - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SquirrelMail Multiple Cross-Site Scripting Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| APPLE-SA-2007-07-31 Security Update 2007-007 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| rPath update for squirrelmail - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| [SECURITY] Fedora Core 5 Update: squirrelmail-1.4.8-3.fc5 | FedoraNEWS.ORG | af854a3a-2127-422b-91ae-364da2661108 | fedoranews.org | |
| Mac OS X Security Update Fixes Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-1241-1 squirrelmail | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Apple Mac OS X 2007-007 Multiple Security Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| SquirrelMail - Webmail for Nuts! | af854a3a-2127-422b-91ae-364da2661108 | squirrelmail.org | |
| Fedora update for squirrelmail - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| issues.rpath.com/browse/RPL-849 | af854a3a-2127-422b-91ae-364da2661108 | issues.rpath.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Debian update for squirrelmail - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SquirrelMail Multiple Cross Site Scripting and Input Validation Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| About Security Update 2007-007 | af854a3a-2127-422b-91ae-364da2661108 | docs.info.apple.com | |
| SGI Advanced Linux Environment 3 Multiple Updates - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| patches.sgi.com/support/free/security/advisories/20070201-01-P.asc | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| [SECURITY] Fedora Core 6 Update: squirrelmail-1.4.8-3.fc6 | FedoraNEWS.ORG | af854a3a-2127-422b-91ae-364da2661108 | fedoranews.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| SecurityTracker.com Archives - SquirrelMail Input Validation Flaws in Compose, Draft, and HTML Viewing Functions Permit Cross-Site Scripting Attacks | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| SourceForge.net: SquirrelMail: Files | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-03-14 | Mark J Cox | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
There are currently no legacy QID mappings associated with this CVE.