Description
functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | squirrelmail | 2:1.4.15-4+lenny3.1 | DSA-2091-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squirrelmail | 1.4.8-5.el5_7.13 | RHSA-2012:0103 |
| RHEL 4 | squirrelmail | 1.4.8-18.el4 | RHSA-2012:0103 |
Advisories 2
- DSA-2091-1 squirrelmail - cross-site request forgery Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2012:0103 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- FEDORA-2010-11422 vendor-advisory
- http://support.apple.com/kb/HT5130
- squirrelmail-imap-dos(61124) vdb-entry
- FEDORA-2010-11410 vendor-advisory
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972
- DSA-2091 vendor-advisory
- APPLE-SA-2012-02-01-1 vendor-advisory
- 40964 third-party-advisory
- ADV-2010-2080 vdb-entry
- 42399 vdb-entry
- RHSA-2012:0103 vendor-advisory
- 40971 third-party-advisory
- http://squirrelmail.org/security/issue/2010-07-23
- ADV-2010-2070 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=618096