{"id":"CVE-2006-6142","aliases":["DEBIAN-CVE-2006-6142","DSA-1241-1","EUVD-2006-6125","GHSA-58cj-jwpm-3hvq","RHSA-2007:0022"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow...","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving \"a shortcoming in the magicHTML filter.\"","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02512,"percentile":0.84895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2006-12-05T11:00:00Z","modified":"2026-06-16T22:32:33Z","fixes":[{"ecosystem":"Debian:3.1","package":"squirrelmail","fixed_in":["2:1.4.4-10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"squirrelmail","fixed_in":["0:1.4.8-4.el3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"squirrelmail","fixed_in":["0:1.4.8-4.el3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"squirrelmail","fixed_in":["0:1.4.8-4.el3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"squirrelmail","fixed_in":["0:1.4.8-4.el3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"squirrelmail","fixed_in":["0:1.4.8-4.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"squirrelmail","fixed_in":["0:1.4.8-4.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"squirrelmail","fixed_in":["0:1.4.8-4.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"squirrelmail","fixed_in":["0:1.4.8-4.el4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:3.1","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.4.4-10"}]}],"versions":["2:1.4.4-5","2:1.4.4-6","2:1.4.4-6sarge1","2:1.4.4-7","2:1.4.4-8","2:1.4.4-9"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-4.el4"}]}]}],"products":[{"vendor":"squirrelmail","product":"squirrelmail"}],"references":[{"url":"http://www.vupen.com/english/advisories/2007/2732","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:226","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://secunia.com/advisories/23195","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2007-0022.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://fedoranews.org/cms/node/2438","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://secunia.com/advisories/23409","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://secunia.com/advisories/23504","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/24284","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30693","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30695","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://secunia.com/advisories/23322","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.novell.com/linux/security/advisories/2007_4_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30694","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.debian.org/security/2006/dsa-1241","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://fedoranews.org/cms/node/2439","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/21414","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://docs.info.apple.com/article.html?artnum=306172","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://sourceforge.net/project/shownotes.php?release_id=468482","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/24004","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/25159","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc","tags":["vendor-advisory","x_refsource_SGI","x_transferred"]},{"url":"http://squirrelmail.org/security/issue/2006-12-02","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.novell.com/linux/security/advisories/2006_29_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://issues.rpath.com/browse/RPL-849","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2006/4828","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://secunia.com/advisories/23811","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://securitytracker.com/id?1017327","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://secunia.com/advisories/26235","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6142","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-58cj-jwpm-3hvq"},{"url":"https://access.redhat.com/errata/RHSA-2007:0022","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=218294","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0022.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-6142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=218297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-6142","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-6142","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving \"a shortcoming in the magicHTML filter.\"","status":"published","published":"2006-12-05T11:00:00Z","modified":"2024-08-07T20:19:34.493Z","updated_at":"2026-11-02T14:33:50.024504Z"}],"euvd":[{"id":"EUVD-2006-6125","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving \"a shortcoming in the magicHTML filter.\"","status":"published","published":"2006-12-05T11:00:00Z","modified":"2024-08-07T20:19:34Z","updated_at":"2026-11-03T01:15:44.814613Z"}],"ghsa":[{"id":"GHSA-58cj-jwpm-3hvq","title":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow...","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving \"a shortcoming in the magicHTML filter.\"","status":"published","published":"2022-05-03T03:16:44Z","modified":"2023-02-01T05:01:22Z","updated_at":"2026-11-02T14:49:42.752886Z"}],"nvd":[{"id":"CVE-2006-6142","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving \"a shortcoming in the magicHTML filter.\"","status":"published","published":"2006-12-05T11:28:00Z","modified":"2026-06-16T22:32:33.007Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:08.546281Z"}],"osv":[{"id":"DSA-1241-1","title":"squirrelmail","status":"published","published":"2006-12-25T00:00:00Z","modified":"2026-03-09T01:01:16.65824Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"RHSA-2007:0022","title":"Red Hat Security Advisory: squirrelmail security update","status":"published","published":"2024-09-15T16:31:43Z","modified":"2025-11-22T10:10:15Z","updated_at":"2026-11-02T15:52:59.70892Z"}]}}