A new squirrelmail package that fixes security issues is now available for
CentOS Linux 3, 4 and 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
SquirrelMail is a standards-based webmail package written in PHP4.
Several HTML filtering bugs were discovered in SquirrelMail. An attacker
by sending an e-mail viewed by a user within SquirrelMail.
Squirrelmail did not sufficiently check arguments to IMG tags in HTML
e-mail messages. This could be exploited by an attacker by sending
arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening
a maliciously crafted HTML e-mail message. (CVE-2007-2589)
Users of SquirrelMail should upgrade to this erratum package, which
contains a backported patch to correct these issues.