Security Update for IceWarp eMail/WebMail Server

Version 9.4.2 of the IceWarp eMail/WebMail Server eliminates four security vulnerabilities. These include two cross-site scripting vulnerabilities, an SQL Injection vulnerability and a weakness in how the system sends mail to users. Under certain circumstances, an attacker could obtain the login credentials of a user.

See also:

• Cross Site Scripting in Email View, a RedTeam advisory.
• User-assisted Cross Site Scripting in RSS Feed Reader, a RedTeam advisory.
• SQL Injection in Groupware Component, a RedTeam advisory.
• Client-Side Specification of "Forgot Password" eMail Content, a RedTeam advisory.

(djwm)