Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | squirrelmail | 2:1.4.15-4+lenny3.1 | DSA-2091-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squirrelmail | 1.4.8-5.el5_4.10 | RHSA-2009:1490 |
| RHEL 4 | squirrelmail | 1.4.8-5.el4_8.8 | RHSA-2009:1490 |
| RHEL 3 | squirrelmail | 1.4.8-16.el3 | RHSA-2009:1490 |
Advisories 2
- DSA-2091-1 squirrelmail - cross-site request forgery Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1490 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- APPLE-SA-2010-06-15-1 vendor-advisory
- FEDORA-2009-8822 vendor-advisory
- https://gna.org/forum/forum.php?forum_id=2146
- ADV-2010-1481 vdb-entry
- http://download.gna.org/nasmail/nasmail-1.7.zip
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
- JVN#30881447 third-party-advisory
- 34627 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
- DSA-2091 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=517312
- MDVSA-2009:222 vendor-advisory
- http://support.apple.com/kb/HT4188
- oval:org.mitre.oval:def:10668 vdb-entry signature
- 40220 third-party-advisory
- 60469 vdb-entry
- squirrelmail-unspecified-csrf(52406) vdb-entry
- 40964 third-party-advisory
- FEDORA-2009-8797 vendor-advisory
- ADV-2010-2080 vdb-entry
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=13818&view=markup&pathrev=13818
- 36196 vdb-entry
- 37415 third-party-advisory
- 36363 third-party-advisory
- http://www.squirrelmail.org/security/issue/2009-08-12
- ADV-2009-3315 vdb-entry
- 57001 vdb-entry
- JVNDB-2009-002207 third-party-advisory
- ADV-2009-2262 vdb-entry