Your message dated Sun, 27 Sep 2009 16:55:46 +0000
with message-id <e1mrx2i-0001om...@ries.debian.org>
and subject line Bug#543818: fixed in squirrelmail 2:1.4.20~rc2-1
has caused the Debian Bug report #543818,
regarding CVE-2009-2964: Multiple cross-site request forgery (CSRF)
vulnerabilities
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
543818: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: squirrelmail
Severity: serious
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for squirrelmail.
CVE-2009-2964[0]:
| Multiple cross-site request forgery (CSRF) vulnerabilities in
| SquirrelMail 1.4.19 and earlier allow remote attackers to hijack the
| authentication of unspecified victims via features such as send
| message and change preferences, related to (1)
| functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3)
| src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6)
| src/folders_create.php, (7) src/folders_delete.php, (8)
| src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10)
| src/folders_subscribe.php, (11) src/move_messages.php, (12)
| src/options.php, (13) src/options_highlight.php, (14)
| src/options_identities.php, (15) src/options_order.php, (16)
| src/search.php, and (17) src/vcard.php.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2964
http://security-tracker.debian.net/tracker/CVE-2009-2964
Cheers,
Giuseppe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkqWLggACgkQNxpp46476aq4qQCfd7xGKycb4zbR7luKUQdi8UeJ
YiAAnRkV5L1Tw1m62WToOIynC7NVSb1B
=fHbw
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
Source: squirrelmail
Source-Version: 2:1.4.20~rc2-1
We believe that the bug you reported is fixed in the latest version of
squirrelmail, which is due to be installed in the Debian FTP archive:
squirrelmail_1.4.20~rc2-1.diff.gz
to pool/main/s/squirrelmail/squirrelmail_1.4.20~rc2-1.diff.gz
squirrelmail_1.4.20~rc2-1.dsc
to pool/main/s/squirrelmail/squirrelmail_1.4.20~rc2-1.dsc
squirrelmail_1.4.20~rc2-1_all.deb
to pool/main/s/squirrelmail/squirrelmail_1.4.20~rc2-1_all.deb
squirrelmail_1.4.20~rc2.orig.tar.gz
to pool/main/s/squirrelmail/squirrelmail_1.4.20~rc2.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 543...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <th...@debian.org> (supplier of updated squirrelmail package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 27 Sep 2009 16:46:03 +0200
Source: squirrelmail
Binary: squirrelmail
Architecture: source all
Version: 2:1.4.20~rc2-1
Distribution: unstable
Urgency: medium
Maintainer: Jeroen van Wolffelaar <jer...@wolffelaar.nl>
Changed-By: Thijs Kinkhorst <th...@debian.org>
Description:
squirrelmail - Webmail for nuts
Closes: 543818
Changes:
squirrelmail (2:1.4.20~rc2-1) unstable; urgency=medium
.
* New upstream release candidate.
+ Addresses cross site request forgery (CVE-2009-2964,
closes: #543818).
* Update to policy 3.8.3, no changes necessary.
Checksums-Sha1:
b678a099c0d89f7c57d8a95beff084dce27d2f3c 1527 squirrelmail_1.4.20~rc2-1.dsc
11e1d8142d371f169bf14deec13659847e81b67b 648459
squirrelmail_1.4.20~rc2.orig.tar.gz
11e967df46aa8cc63168d87ae557177d68c96106 20230
squirrelmail_1.4.20~rc2-1.diff.gz
47c7f192c5881e972c4f08b22e4264eada1b2796 623614
squirrelmail_1.4.20~rc2-1_all.deb
Checksums-Sha256:
52be2e636c05753f3eb8a9a88432a6315e1a003aca990418b3aae5d9efbd8524 1527
squirrelmail_1.4.20~rc2-1.dsc
6c3fc1ab5d0cbc25c7106452c049b36e80c0ab3dd6a8ff76255b66ef724d91b5 648459
squirrelmail_1.4.20~rc2.orig.tar.gz
fb0be9296e32ed2f8cc6f1ccb3b3a145c2ab8b957b6074a660bdf90efd971fd3 20230
squirrelmail_1.4.20~rc2-1.diff.gz
997921d0826791572855be23bd749eff127565b94982bf3d29bad95e3dd5b55f 623614
squirrelmail_1.4.20~rc2-1_all.deb
Files:
bf54f34da64083255431c8e33fbf1ccd 1527 web optional
squirrelmail_1.4.20~rc2-1.dsc
03523e8c7ad9d630988d5001c5743b69 648459 web optional
squirrelmail_1.4.20~rc2.orig.tar.gz
ec4771b958f266958b1734dca301eed2 20230 web optional
squirrelmail_1.4.20~rc2-1.diff.gz
8ea2b96e3859c393dbdcb53717edbb08 623614 web optional
squirrelmail_1.4.20~rc2-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBCAAGBQJKv3sYAAoJECIIoQCMVaAc8EAH/iPVf2rLcy+s9OTEyNl+l1sl
Vm4SlOmN1nugu4sXrtWjwYwOfiX8r+lK6JtQzUsYvdm9IJIRXRYGfSaAjn2z41Q9
kBkDXHvlTIzdI92tK/TjkDppMEOaASe3dzowLGRswMH9sUGn4PgmL5BEqQXHiWYM
PPVRcmio/U/8O369Al7LOOX7sThkgTEFIkPaU4K9CgBUEwQtL3RXBq8QI9fGc5Te
78zVxrJyep7Wb7PK0XKKTLdnqF6Nk5NvgZaQ95CwJ0OR0Q1mLSWuvfgakIH3vpl1
KF1+f9j0vkAnuVdZwYbrzwkXC5sqTeq01xdPHTZlNIqiLOrM6TqWvrYcZXFNNtY=
=j4hs
-----END PGP SIGNATURE-----
--- End Message ---
