squirrelmail security update

A new squirrelmail package that fixes a security issue as well as several
bugs is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A dynamic variable evaluation flaw was found in SquirrelMail. Users who
have an account on a SquirrelMail server and are logged in could use this
flaw to overwrite variables which may allow them to read or write other
users' preferences or attachments. (CVE-2006-4019)

Users of SquirrelMail should upgrade to this erratum package, which
contains SquirrelMail 1.4.8 to correct this issue. This package also
contains a number of additional patches to correct various bugs.

Note: After installing this update, users are advised to restart their httpd
service to ensure that the new version functions correctly.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

192236 - [Squirrelmail] sqspell_config.php not listed as a config file
194457 - squirrelmail cannot handle handle multibyte characters in attachment.
194598 - "Message Highlighting" help not translated in ja_JP
194599 - ja_JP help pages are garbled
195452 - squirrelmail view_text.php cannot handle handle multibyte characters in attachment.
195639 - Squirrelmail file download issue on JP MS Windows XP.
196017 - squirrelmail cannot convert Subject to zen-kaku kata-kana.
196117 - Wrong ja_JP translation for "refresh folder list"
202195 - CVE-2006-4019 Squirrelmail authenticated user variable overwriting

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4019
http://www.redhat.com/security/updates/classification/#moderate