[SECURITY] Fedora 29 Update: squirrelmail-1.4.23-1.fc29.20190710
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-1a87523729
2019-08-21 02:11:25.390054
--------------------------------------------------------------------------------
Name : squirrelmail
Product : Fedora 29
Version : 1.4.23
Release : 1.fc29.20190710
URL : http://www.squirrelmail.org/
Summary : webmail client written in php
Description :
SquirrelMail is a basic webmail package written in PHP4. It
includes built-in pure PHP support for the IMAP and SMTP protocols, and
all pages render in pure HTML 4.0 (with no JavaScript) for maximum
compatibility across browsers. It has very few requirements and is very
easy to configure and install.
--------------------------------------------------------------------------------
Update Information:
updated to 1.4 branch snapshot containing several security fixes
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jul 10 2019 Michal Hlavinka <mhlavink(a)redhat.com> - 1.4.23-1.20190710
- squirrelmail updated to newer snapshot
* Sun Feb 3 2019 Fedora Release Engineering <releng(a)fedoraproject.org> -
1.4.23-1.20180816
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1616100 - CVE-2018-14955 squirrelmail: persistent XSS in message display via
SVG animations [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1616100
[ 2 ] Bug #1616097 - CVE-2018-14954 squirrelmail: persistent XSS in message display the
formaction attribute [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1616097
[ 3 ] Bug #1616094 - CVE-2018-14953 squirrelmail: persistent XSS in message display via
a "<math xlink:href=" [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1616094
[ 4 ] Bug #1616090 - CVE-2018-14952 squirrelmail: persistent XSS in message display via
a "<math><maction xlink:href=" [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1616090
[ 5 ] Bug #1616087 - CVE-2018-14951 squirrelmail: persistent XSS in message display via
a "<form action='data:text" [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1616087
[ 6 ] Bug #1616084 - CVE-2018-14950 squirrelmail: persistent XSS in message display via
a "<svg><a xlink:href=" [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1616084
[ 7 ] Bug #1560341 - CVE-2018-8741 SquirrelMail: Directory traversal flaw in
Deliver.class.php can allow a remote attacker to retrieve or delete arbitrary files
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1560341
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-1a87523729' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------