Debian: DSA-756-1 Critical: Multiple Threats in Squirrelmail

Martijn Brinkers discovered cross-site scripting vulnerabilities
that allow remote attackers to inject arbitrary web script or HTML
in the URL and e-mail messages.

CAN-2005-2095

James Bercegay of GulfTech Security discovered a vulnerability in
the variable handling which could lead to attackers altering other
people's preferences and possibly reading them, writing files at
any location writable for www-data and cross site scripting.

For the old stable distribution (woody) these problems have been fixed in
version 1.2.6-4.

For the stable distribution (sarge) these problems have been fixed in
version 1.4.4-6sarge1.

For the unstable distribution (sid) these problems have been fixed in
version 1.4.4-6sarge1.

We recommend that you upgrade your squirrelmail package.


Upgrade Instructions
- --------------------wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package mana...