[SM-ANNOUNCE] SquirrelMail 1.4.9 Released

--===============0126481351==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-Bsk9unIqUzfCdiuWJoh6"


--=-Bsk9unIqUzfCdiuWJoh6
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hello All,

The SquirrelMail Project Team is proud to announce the release of
SquirrelMail 1.4.7. This version is a maintenance release, addressing
the following problems since 1.4.6:
- Some security fixes (see below)
- Small enhancements
- A collection of bugfixes (see ChangeLog)

Security issues
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This release addresses security issues found since the release of 1.4.8:

Cross site scripting via malicious input the mailto parameter of
webmail.php, the session and delete_draft parameters of compose.php and
via a shortcoming in the magicHTML filter.

This is CVE-2006-6142. Thanks for Martijn Brinkers for his continued
research that uncovered these issues.

We've also changed SquirrelMail attachment handling to work around an
issue in Internet Explorer: the browser will attempt to guess the MIME
type of attachments based on content, not the MIME header we send.
Attachments could fake to be an 'harmless' image/jpeg, while they were
in fact HTML that Internet Explorer would render.

Further details on SquirrelMail vulnerabilities can be found at the
following address:

  http://www.squirrelmail.org/security/

We strongly encourage any persons uncovering security issues to
contact the SquirrelMail team via security <at> squirrelmail.org.

Package md5sums
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

b3dc6e3c5accb9b88bf6ebfd87336b96  squirrelmail-1.4.9.tar.bz2
5a3ecbda6d8378c68fa40b4ac5b2d487  squirrelmail-1.4.9.tar.gz
875848f25d481b59552d4e93aaacba4c  squirrelmail-1.4.9.zip


Download at:

  http://www.squirrelmail.org/download.php

Happy SquirrelMailing!

--=20
Thijs Kinkhorst
SquirrelMail Project Team

--=-Bsk9unIqUzfCdiuWJoh6
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQBFcaBdJdKMxZV9WM8RAnqbAKCn9PsQiQ6D58tKJqK1Z+B+dtBREQCg3mJn
g3KMElpjB571fjiUW/SoPE0=
=6KXU
-----END PGP SIGNATURE-----

--=-Bsk9unIqUzfCdiuWJoh6--


--===============0126481351==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
--===============0126481351==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline