295.ca Mail 2.0.0

Based on SquirrelMail 1.4.22 · Version 2.0.0 · Patch 96

Copyright (C) 1999-2026 The SquirrelMail Project Team. Hardened by Fibernetics for 295.ca Mail.

This page lists CVEs that affected stock SquirrelMail 1.4.x after the last upstream update (2011), and the Fibernetics hardening applied in 295.ca Mail 2.0.

Fibernetics hardening

• PHP 7.4 and PHP 8 compatibility (foreach not each(), string offsets, constructors, no ereg / curly-brace offsets / string assert)
• Classic frameset right_frame allowlist + HTML escaping (no attribute breakout)
• Address book backends instantiated from a fixed class whitelist (no eval)
• HTML mail sanitizer also strips svg/math/video/audio/form containers
• CSRF security tokens reused for an hour (Classic left-dock Enhanced switch stays valid on busy pages); prefval stored as TEXT
• Favicon only on the frameset parent (Classic) plus login/security; not in every frame
• Session idle watch in Classic left pane only (one poll; right pane waits for left refresh)
• Login abuse controls: failed-attempt tracking, captcha gate, temporary IP lockout (badpeople); IP from REMOTE_ADDR unless behind configured trusted proxies
• Session ID regeneration after successful authentication (session fixation resistance)
• Clickjacking defenses: X-Frame-Options SAMEORIGIN, CSP frame-ancestors; JavaScript frame check on top-level pages (Classic frames rely on headers)
• Browser headers: X-Content-Type-Options nosniff, Referrer-Policy same-origin, Permissions-Policy locked down
• Session and UI cookies set SameSite=Lax (with Secure when HTTPS)
• Login / redirect pages sent with no-cache headers
• Secure preference storage via mysqli; theme paths validated before use
• UI preference cookies for theme / Enhanced set with correct Path+Secure (server-side; login uses login_prefs.php)
• Compose editor: link URLs restricted to http(s)/mailto; HTML seed sanitized; one modern editor for Classic and Enhanced
• IMAP password stored in the PHP session (OTP-encrypted); no longer sent as a key cookie
• Purge Trash uses POST with a CSRF token; Empty is a header button on folders listed in the config file (expunges that folder only, never child folders)
• Calendar v2 in Enhanced Mode (month grid, day agenda, compact event form); Classic keeps the original calendar screens. Both use the same per-user .cal event files
• Eyesaver overlay stylesheet is always loaded in Enhanced and toggled in place (no reload back to the inbox)
• Login requires JavaScript and cookies (button stays off until both work; username/password are not remembered)
• Message view CSP img-src 'self' when remote images are blocked
• Security headers on attachment download, session probe, and image viewer
• Attachment image viewer builds links from known parameters (no QUERY_STRING reflection)
• Public security.php hardening / CVE page from the login screen; full About still requires login
• Sendmail delivery hardened against shell metacharacters in From (CVE-2017-7692)
• Attachment local names restricted to alphanumeric (CVE-2018-8741)
• HTML mail sanitizer strips dangerous RCDATA/RAWTEXT containers (CVE-2019-12970)
• Encoded e-mail header display always HTML-escaped for UI output (CVE-2025-30090)
• Request cache: OPcache warmup, APCu, MySQL sm_cache; folder list still falls back to the session then IMAP
• Enhanced mode modern UI (optional) with theme-driven colours, phone/tablet layout, Calendar v2, Eyesaver, and asset cache busting
• Removed outdated stock SquirrelMail features (see About section) to simplify Options and cut dead code

Security patches (CVE)

Patched+Hardened by Fibernetics