CVE catalog

CVE-2009-1381

squirrelmail - incomplete fix

[CVE catalog]

The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579. Not vulnerable. This issue did not affect the versions of squirrelmail as shipped with Red Hat Enterprise Linux 3, 4, or 5. Updates for squirrelmail released via RHSA-2009:1066 fixed original flaw CVE-2009-1579 without introducing CVE-2009-1381. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.94% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debian5.0squirrelmail2:1.4.15-4UnknownSource applicability is not established[DSA-1802-2]
Debian5.0squirrelmail2:1.4.15-4+lenny1UnknownSource applicability is not established[DSA-1802-2]
Debian5.0squirrelmail2:1.4.15-4+lenny2UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-1UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-2UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-3UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-4UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-5UnknownSource applicability is not established[DSA-1802-2]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debian4.0squirrelmail2:1.4.9a-1UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-2UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-3UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-4UnknownSource applicability is not established[DSA-1802-2]
Debian4.0squirrelmail2:1.4.9a-5UnknownSource applicability is not established[DSA-1802-2]
Debian5.0squirrelmail2:1.4.15-4UnknownSource applicability is not established[DSA-1802-2]
Debian5.0squirrelmail2:1.4.15-4+lenny1UnknownSource applicability is not established[DSA-1802-2]
Debian5.0squirrelmail2:1.4.15-4+lenny2UnknownSource applicability is not established[DSA-1802-2]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "squirrelmail",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:1.4.9a-5"
            }
          ]
        }
      ],
      "release": "4.0",
      "versions": [
        "2:1.4.9a-1",
        "2:1.4.9a-2",
        "2:1.4.9a-3",
        "2:1.4.9a-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DSA-1802-2",
      "fixed_version": "2:1.4.9a-5",
      "provider_source": "pypi",
      "provider_record_id": "DSA-1802-2",
      "provider_updated_at": "2026-03-09T01:20:03.146813Z",
      "applicability_unknown": true
    },
    {
      "name": "squirrelmail",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:1.4.15-4+lenny2"
            }
          ]
        }
      ],
      "release": "5.0",
      "versions": [
        "2:1.4.15-4",
        "2:1.4.15-4+lenny1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DSA-1802-2",
      "fixed_version": "2:1.4.15-4+lenny2",
      "provider_source": "pypi",
      "provider_record_id": "DSA-1802-2",
      "provider_updated_at": "2026-03-09T01:20:03.146813Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]