Description
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | squirrelmail | 2:1.4.9a-2 | DSA-1290-1 |
| Debian 3.1 | squirrelmail | 2:1.4.4-11 | DSA-1290-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squirrelmail | 1.4.8-4.0.1.el5 | RHSA-2007:0358 |
| RHEL 4 | squirrelmail | 1.4.8-4.0.1.el4 | RHSA-2007:0358 |
| RHEL 3 | squirrelmail | 1.4.8-6.el3 | RHSA-2007:0358 |
Advisories 2
- DSA-1290-1 squirrelmail Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0358 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- ADV-2007-2732 vdb-entry
- 25200 third-party-advisory
- ADV-2007-1748 vdb-entry
- 25320 third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- squirrelmail-multiple-scripts-csrf(34219) vdb-entry
- http://www.squirrelmail.org/security/issue/2007-05-09
- MDKSA-2007:106 vendor-advisory
- SUSE-SR:2007:013 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=306172
- oval:org.mitre.oval:def:11448 vdb-entry signature
- RHSA-2007:0358 vendor-advisory
- 25159 vdb-entry
- 35889 vdb-entry
- 25787 third-party-advisory
- 26235 third-party-advisory