CVE-2009-1578

Publication date 14 May 2009

Last updated 17 July 2025

Ubuntu priority

Description

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php; (2) PHP_SELF; and (3) the query string (aka QUERY_STRING).

Status

Show unmaintained releases

Package	Ubuntu Release	Status
squirrelmail	9.10 karmic	Not affected
	9.04 jaunty	Fixed 2:1.4.15-4ubuntu0.1
	8.10 intrepid	Fixed 2:1.4.15-3ubuntu0.2
	8.04 LTS hardy	Fixed 2:1.4.13-2ubuntu1.3
	6.06 LTS dapper	Ignored end of life

How can I get the fixes?
What do statuses mean?
Patch details

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
squirrelmail	Debdiff: https://bugs.launchpad.net/bugs/375513

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2009-1578