Description
PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | squirrelmail | 1.4.3a-9.EL4 | RHSA-2005:099 |
| RHEL 3 | squirrelmail | 1.4.3a-9.EL3 | RHSA-2005:135 |
Advisories 2
- RHSA-2005:135 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2005:099 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- squirrelmail-frame-file-include(19037) vdb-entry
- oval:org.mitre.oval:def:10670 vdb-entry signature
- http://www.squirrelmail.org/security/issue/2005-01-19?PHPSESSID=8af117822fb1ca3aa966a64248b5d223
- RHSA-2005:135 vendor-advisory
- 20050129 SquirrelMail Security Advisory mailing-list
- RHSA-2005:099 vendor-advisory
- APPLE-SA-2005-03-21 vendor-advisory
- 13962 third-party-advisory
- GLSA-200501-39 vendor-advisory