Description
SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | squirrelmail | 1:1.2.6-1.4 | DSA-535 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | squirrelmail | 1.4.3-0.e3.1 | RHSA-2004:240 |
Advisories 2
- DSA-535 squirrelmail - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2004:240 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 12289 third-party-advisory
- 10397 vdb-entry
- oval:org.mitre.oval:def:11446 vdb-entry signature
- 6841 vdb-entry
- FEDORA-2004-160 vendor-advisory
- 11686 third-party-advisory
- 11685 third-party-advisory
- 11870 third-party-advisory
- [squirrelmail-cvs] 20040427 [SM-CVS] CVS: squirrelmail/functions abook_database.php,1.15.2.1,1.15.2.2 mailing-list
- DSA-535 vendor-advisory
- RHSA-2004:240 vendor-advisory
- squirrelmail-sql-injection(16235) vdb-entry
- FEDORA-2004-1733 vendor-advisory
- GLSA-200405-16 vendor-advisory
- [squirrelmail-devel] 20040511 [SM-DEVEL] SquirrelMail 1.4.3-RC1 Release mailing-list
- oval:org.mitre.oval:def:1033 vdb-entry signature
- CLA-2004:858 vendor-advisory
- APPLE-SA-2004-09-07 vendor-advisory
- O-212 third-party-advisory government-resource