Re: Squirrelmail CVE duplicates

[Jan Lieskovsky <jlieskov () redhat com>]

Hi Moritz,

  thank you for checking this.

On 07/24/2011 06:17 PM, Moritz Muehlenhoff wrote:
> Hi,
> there seems to be a duplicate CVE assignment for Squirrelmail?
>
> CVE-2010-4555 / CVE-2011-2753

If I got it right, the CVE-2010-4555 ID has been assigned to the XSS
flaws:

Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail
webmail client:
* XSS flaws in generic options inputs,
* XSS flaw in the SquirrelSpell plug-in,
* XSS flaw in the Index Order page.

[1]
https://bugzilla.redhat.com/show_bug.cgi?id=720694#c0

while the CVE-2011-2753 ID has been assigned to the CSRF protection add-ons:

Also protection against Cross-site Request Forgery (CSRF) flaws has
been added to the empty trash feature and to the Index Order page.
[2] https://bugzilla.redhat.com/show_bug.cgi?id=720694#c0
[3] https://bugzilla.redhat.com/show_bug.cgi?id=722832#c0

Hope this helps && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> Cheers,
>          Moritz