Secunia

Román Medina-Heigl Hernández has reported a vulnerability in SquirrelMail, which can be exploited by malicious people to conduct script injection attacks.

The vulnerability is caused due to missing input validation of the "Content-Type:" header. This can be exploited via specially crafted emails containing HTML or script code in the "Content-Type:" header to execute the code in a user's browser session in context of a vulnerable site, when the malicious email is viewed.

The vulnerability has been reported in versions 1.4.3-rc1, 1.5.0 and 1.5.1 (cvs). Prior versions may also be affected.

NOTE: A number of other unspecified cross-site scripting vulnerabilities have also been discovered.

Solution
Update to version 1.4.3.
Further details available in Customer Area

Provided and/or discovered by
Román Medina-Heigl Hernández

Changelog
Further details available in Customer Area

Original Advisory
http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt

Deep Links
Links available in Customer Area