CVE-2006-4019

Description

Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.

6.4

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 26.68% Top 5%

Vendor Advisory debian.org Vendor Advisory novell.com Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory sgi.com Vendor Advisory mandriva.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/21586	third party advisory
https://issues.rpath.com/browse/RPL-577
http://www.vupen.com/english/advisories/2007/2732	vdb entry
http://www.debian.org/security/2006/dsa-1154	vendor advisory
http://secunia.com/advisories/21354	patch vendor advisory third party advisory
http://secunia.com/advisories/22487	third party advisory
http://securitytracker.com/id?1016689	vdb entry
http://www.novell.com/linux/security/advisories/2006_23_sr.html	vendor advisory
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	vendor advisory
http://www.vupen.com/english/advisories/2006/3271	vdb entry
http://secunia.com/advisories/21444	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28365	vdb entry
http://secunia.com/advisories/22080	third party advisory
http://attrition.org/pipermail/vim/2006-August/000970.html	mailing list
http://www.securityfocus.com/bid/19486	vdb entry
http://www.redhat.com/support/errata/RHSA-2006-0668.html	vendor advisory
http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch	patch
http://www.squirrelmail.org/security/issue/2006-08-11	patch
http://secunia.com/advisories/22104	third party advisory
http://www.securityfocus.com/archive/1/442993/100/0/threaded	mailing list
http://www.securityfocus.com/archive/1/442980/100/0/threaded	mailing list
http://marc.info/?l=full-disclosure&m=115532449024178&w=2	mailing list
http://www.osvdb.org/27917	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533	signature vdb entry
http://docs.info.apple.com/article.html?artnum=306172
http://www.securityfocus.com/bid/25159	vdb entry
ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:147	vendor advisory
http://secunia.com/advisories/26235	third party advisory

Frequently Asked Questions

What is the severity of CVE-2006-4019?: CVE-2006-4019 has been scored as a medium severity vulnerability.
How to fix CVE-2006-4019?: To fix CVE-2006-4019, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-4019 being actively exploited in the wild?: It is possible that CVE-2006-4019 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~27% probability that this vulnerability will be exploited by malicious actors in the next 30 days.