Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | squirrelmail | 2:1.4.21-2 | DSA-2291-1 |
| Debian 5.0 | squirrelmail | 2:1.4.15-4+lenny5 | DSA-2291-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squirrelmail | 1.4.8-5.el5_7.13 | RHSA-2012:0103 |
| RHEL 4 | squirrelmail | 1.4.8-18.el4 | RHSA-2012:0103 |
Advisories 2
- DSA-2291-1 squirrelmail - various issues Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2012:0103 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- DSA-2291 vendor-advisory
- MDVSA-2011:123 vendor-advisory
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
- https://bugzilla.redhat.com/show_bug.cgi?id=720694
- RHSA-2012:0103 vendor-advisory
- squirrelmail-authentication-csrf(68586) vdb-entry