CVE-2006-4019 (GCVE-0-2006-4019)
Vulnerability from cvelistv5
Published
2006-08-11 21:00
Modified
2024-08-07 18:57
Severity ?
CWE
  • n/a
Summary
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
References
cve@mitre.org ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc
cve@mitre.org http://attrition.org/pipermail/vim/2006-August/000970.html
cve@mitre.org http://docs.info.apple.com/article.html?artnum=306172
cve@mitre.org http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
cve@mitre.org http://marc.info/?l=full-disclosure&m=115532449024178&w=2
cve@mitre.org http://secunia.com/advisories/21354 Patch, Vendor Advisory
cve@mitre.org http://secunia.com/advisories/21444
cve@mitre.org http://secunia.com/advisories/21586
cve@mitre.org http://secunia.com/advisories/22080
cve@mitre.org http://secunia.com/advisories/22104
cve@mitre.org http://secunia.com/advisories/22487
cve@mitre.org http://secunia.com/advisories/26235
cve@mitre.org http://securitytracker.com/id?1016689
cve@mitre.org http://www.debian.org/security/2006/dsa-1154
cve@mitre.org http://www.mandriva.com/security/advisories?name=MDKSA-2006:147
cve@mitre.org http://www.novell.com/linux/security/advisories/2006_23_sr.html
cve@mitre.org http://www.osvdb.org/27917
cve@mitre.org http://www.redhat.com/support/errata/RHSA-2006-0668.html
cve@mitre.org http://www.securityfocus.com/archive/1/442980/100/0/threaded
cve@mitre.org http://www.securityfocus.com/archive/1/442993/100/0/threaded
cve@mitre.org http://www.securityfocus.com/bid/19486
cve@mitre.org http://www.securityfocus.com/bid/25159
cve@mitre.org http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch Patch
cve@mitre.org http://www.squirrelmail.org/security/issue/2006-08-11 Patch
cve@mitre.org http://www.vupen.com/english/advisories/2006/3271
cve@mitre.org http://www.vupen.com/english/advisories/2007/2732
cve@mitre.org https://exchange.xforce.ibmcloud.com/vulnerabilities/28365
cve@mitre.org https://issues.rpath.com/browse/RPL-577
cve@mitre.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533
af854a3a-2127-422b-91ae-364da2661108 ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc
af854a3a-2127-422b-91ae-364da2661108 http://attrition.org/pipermail/vim/2006-August/000970.html
af854a3a-2127-422b-91ae-364da2661108 http://docs.info.apple.com/article.html?artnum=306172
af854a3a-2127-422b-91ae-364da2661108 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
af854a3a-2127-422b-91ae-364da2661108 http://marc.info/?l=full-disclosure&m=115532449024178&w=2
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/21354 Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/21444
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/21586
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/22080
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/22104
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/22487
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/26235
af854a3a-2127-422b-91ae-364da2661108 http://securitytracker.com/id?1016689
af854a3a-2127-422b-91ae-364da2661108 http://www.debian.org/security/2006/dsa-1154
af854a3a-2127-422b-91ae-364da2661108 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147
af854a3a-2127-422b-91ae-364da2661108 http://www.novell.com/linux/security/advisories/2006_23_sr.html
af854a3a-2127-422b-91ae-364da2661108 http://www.osvdb.org/27917
af854a3a-2127-422b-91ae-364da2661108 http://www.redhat.com/support/errata/RHSA-2006-0668.html
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/archive/1/442980/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/archive/1/442993/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/19486
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/25159
af854a3a-2127-422b-91ae-364da2661108 http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch Patch
af854a3a-2127-422b-91ae-364da2661108 http://www.squirrelmail.org/security/issue/2006-08-11 Patch
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2006/3271
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2007/2732
af854a3a-2127-422b-91ae-364da2661108 https://exchange.xforce.ibmcloud.com/vulnerabilities/28365
af854a3a-2127-422b-91ae-364da2661108 https://issues.rpath.com/browse/RPL-577
af854a3a-2127-422b-91ae-364da2661108 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T18:57:43.887Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "21586",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21586"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-577"
          },
          {
            "name": "ADV-2007-2732",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2732"
          },
          {
            "name": "DSA-1154",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-1154"
          },
          {
            "name": "21354",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21354"
          },
          {
            "name": "22487",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22487"
          },
          {
            "name": "1016689",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1016689"
          },
          {
            "name": "SUSE-SR:2006:023",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
          },
          {
            "name": "APPLE-SA-2007-07-31",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
          },
          {
            "name": "ADV-2006-3271",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3271"
          },
          {
            "name": "21444",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21444"
          },
          {
            "name": "squirrelmail-compose-variable-overwrite(28365)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
          },
          {
            "name": "22080",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22080"
          },
          {
            "name": "20060811 SquirrelMail issue is dynamic variable evaluation",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
          },
          {
            "name": "19486",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/19486"
          },
          {
            "name": "RHSA-2006:0668",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
          },
          {
            "name": "22104",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22104"
          },
          {
            "name": "20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
          },
          {
            "name": "20060811 rPSA-2006-0152-1 squirrelmail",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
          },
          {
            "name": "20060811 rPSA-2006-0152-1 squirrelmail",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
          },
          {
            "name": "27917",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/27917"
          },
          {
            "name": "oval:org.mitre.oval:def:11533",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=306172"
          },
          {
            "name": "25159",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25159"
          },
          {
            "name": "20061001-01-P",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
          },
          {
            "name": "MDKSA-2006:147",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
          },
          {
            "name": "26235",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26235"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-08-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "21586",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21586"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-577"
        },
        {
          "name": "ADV-2007-2732",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2732"
        },
        {
          "name": "DSA-1154",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-1154"
        },
        {
          "name": "21354",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21354"
        },
        {
          "name": "22487",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22487"
        },
        {
          "name": "1016689",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1016689"
        },
        {
          "name": "SUSE-SR:2006:023",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
        },
        {
          "name": "APPLE-SA-2007-07-31",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
        },
        {
          "name": "ADV-2006-3271",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3271"
        },
        {
          "name": "21444",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21444"
        },
        {
          "name": "squirrelmail-compose-variable-overwrite(28365)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
        },
        {
          "name": "22080",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22080"
        },
        {
          "name": "20060811 SquirrelMail issue is dynamic variable evaluation",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
        },
        {
          "name": "19486",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/19486"
        },
        {
          "name": "RHSA-2006:0668",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
        },
        {
          "name": "22104",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22104"
        },
        {
          "name": "20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
        },
        {
          "name": "20060811 rPSA-2006-0152-1 squirrelmail",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
        },
        {
          "name": "20060811 rPSA-2006-0152-1 squirrelmail",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
        },
        {
          "name": "27917",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/27917"
        },
        {
          "name": "oval:org.mitre.oval:def:11533",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=306172"
        },
        {
          "name": "25159",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25159"
        },
        {
          "name": "20061001-01-P",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
        },
        {
          "name": "MDKSA-2006:147",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
        },
        {
          "name": "26235",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26235"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4019",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "21586",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21586"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-577",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-577"
            },
            {
              "name": "ADV-2007-2732",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2732"
            },
            {
              "name": "DSA-1154",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-1154"
            },
            {
              "name": "21354",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21354"
            },
            {
              "name": "22487",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22487"
            },
            {
              "name": "1016689",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1016689"
            },
            {
              "name": "SUSE-SR:2006:023",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
            },
            {
              "name": "APPLE-SA-2007-07-31",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
            },
            {
              "name": "ADV-2006-3271",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3271"
            },
            {
              "name": "21444",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21444"
            },
            {
              "name": "squirrelmail-compose-variable-overwrite(28365)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
            },
            {
              "name": "22080",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22080"
            },
            {
              "name": "20060811 SquirrelMail issue is dynamic variable evaluation",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
            },
            {
              "name": "19486",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/19486"
            },
            {
              "name": "RHSA-2006:0668",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
            },
            {
              "name": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch",
              "refsource": "MISC",
              "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
            },
            {
              "name": "http://www.squirrelmail.org/security/issue/2006-08-11",
              "refsource": "CONFIRM",
              "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
            },
            {
              "name": "22104",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22104"
            },
            {
              "name": "20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
            },
            {
              "name": "20060811 rPSA-2006-0152-1 squirrelmail",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
            },
            {
              "name": "20060811 rPSA-2006-0152-1 squirrelmail",
              "refsource": "FULLDISC",
              "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
            },
            {
              "name": "27917",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/27917"
            },
            {
              "name": "oval:org.mitre.oval:def:11533",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306172",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=306172"
            },
            {
              "name": "25159",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25159"
            },
            {
              "name": "20061001-01-P",
              "refsource": "SGI",
              "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
            },
            {
              "name": "MDKSA-2006:147",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
            },
            {
              "name": "26235",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26235"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-4019",
    "datePublished": "2006-08-11T21:00:00",
    "dateReserved": "2006-08-08T00:00:00",
    "dateUpdated": "2024-08-07T18:57:43.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2006-4019\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2006-08-11T21:04:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de evaluaci\u00f3n de variable din\u00e1mica en compose.php en SquirrelMail 1.4.0 hasta la versi\u00f3n 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:N\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C179A3C-8C8C-429B-BACA-8ADAE4170465\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AD31177-05BB-4623-AED7-765DB7E44E47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20247A22-9AB9-4BCE-BF28-350B52FBC62D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79E6734C-EE1C-40B6-9759-15298707A6F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6733B8C-5A9E-45CE-8938-F39A69EB0DC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B08E51F1-3764-4146-89C1-20B9B8EE1222\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD4071B2-3D4F-4755-98B1-E28CEB05EA8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF6591E5-5F36-4663-85A6-9D870FD49FC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D062B70A-E5FF-403B-8BD1-777D6462B7CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D4CFD4D-EAC3-4325-A87F-9D5F4C513208\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A884536-4D27-4350-B815-AB4E625879DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7ED3CC3-E0A8-4C20-9EF7-405CD32E9EF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD89F143-EEBF-472D-9653-E7534F5799FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.4_rc1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"442BF5C9-DC58-4A94-A634-33D6A4F3C6DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squirrelmail:squirrelmail:1.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0C44025-C79D-4791-8EF6-3E26786E194E\"}]}]}],\"references\":[{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://attrition.org/pipermail/vim/2006-August/000970.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://docs.info.apple.com/article.html?artnum=306172\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/21354\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/21444\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/21586\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/22080\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/22104\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/22487\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/26235\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securitytracker.com/id?1016689\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2006/dsa-1154\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2006:147\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2006_23_sr.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.osvdb.org/27917\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2006-0668.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/442980/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/442993/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/19486\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/25159\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squirrelmail.org/security/issue/2006-08-11\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.vupen.com/english/advisories/2006/3271\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/2732\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/28365\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://issues.rpath.com/browse/RPL-577\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://attrition.org/pipermail/vim/2006-August/000970.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://docs.info.apple.com/article.html?artnum=306172\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/21354\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/21444\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/21586\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/22080\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/22104\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/22487\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/26235\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1016689\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2006/dsa-1154\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2006:147\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2006_23_sr.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/27917\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2006-0668.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/442980/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/442993/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/19486\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/25159\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squirrelmail.org/security/issue/2006-08-11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.vupen.com/english/advisories/2006/3271\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/2732\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/28365\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://issues.rpath.com/browse/RPL-577\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorSolution\":\"This vulnerability is addressed in the following product release:\\r\\nSquirrelMail, SquirrelMail, 1.4.8\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.