Gentoo Linux Security Advisory GLSA 200603-09 – SquirrelMail does not validate the right_frame parameter in webmail.php, possibly allowing frame replacement or cross-site scripting. Martijn Brinkers and Scott Hughes discovered that MagicHTML fails to handle certain input correctly, potentially leading to cross-site scripting. Vicente Aguilera reported that the sqimap_mailbox_select function did not strip newlines from the mailbox or subject parameter, possibly allowing IMAP command injection. Versions less than 1.4.6 are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/44579/glsa-200603-09.txt
Source: https://packetstormsecurity.com/files/44579/Gentoo-Linux-Security-Advisory-200603-9.html