FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-4019

This CVE name corresponds to:

Entered	Topic
2006-08-12	squirrelmail -- random variable overwrite vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-4019 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-4019
Phase	Assigned(20060808)

Description

Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.

References

Source	Reference
BUGTRAQ	20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack
BUGTRAQ	20060811 rPSA-2006-0152-1 squirrelmail
FULLDISC	20060811 rPSA-2006-0152-1 squirrelmail
CONFIRM	http://docs.info.apple.com/article.html?artnum=306172
APPLE	APPLE-SA-2007-07-31
VIM	20060811 SquirrelMail issue is dynamic variable evaluation
CONFIRM	https://issues.rpath.com/browse/RPL-577
CONFIRM	http://www.squirrelmail.org/security/issue/2006-08-11
MISC	http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch
CONFIRM	https://issues.rpath.com/browse/RPL-577
DEBIAN	DSA-1154
MANDRIVA	MDKSA-2006:147
REDHAT	RHSA-2006:0668
SGI	20061001-01-P
SUSE	SUSE-SR:2006:023
BID	19486
BID	25159
OVAL	oval:org.mitre.oval:def:11533
VUPEN	ADV-2006-3271
VUPEN	ADV-2007-2732
OSVDB	27917
SECTRACK	1016689
SECUNIA	21354
SECUNIA	21444
SECUNIA	21586
SECUNIA	22104
SECUNIA	22487
SECUNIA	22080
SECUNIA	26235
XF	squirrelmail-compose-variable-overwrite(28365)