CVE-2008-3663

Publication date 24 September 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Read the notes from the security team

Status

Package Ubuntu Release Status
squirrelmail 8.10 intrepid
Not affected
8.04 LTS hardy
Fixed 2:1.4.13-2ubuntu1.2
7.10 gutsy
Fixed 2:1.4.10a-2ubuntu0.1
7.04 feisty Ignored end of life, was needed
6.06 LTS dapper
Fixed 2:1.4.6-1ubuntu0.2

Notes

jdstrand

be sure not to introduce CVE-2009-0030 when fixing this