CVE-2010-1637

Publication date 22 June 2010

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
squirrelmail	10.04 LTS lucid	Fixed 2:1.4.20-1ubuntu0.1
	9.10 karmic	Fixed 2:1.4.19-1ubuntu0.2
	9.04 jaunty	Fixed 2:1.4.15-4ubuntu0.4
	8.04 LTS hardy	Fixed 2:1.4.13-2ubuntu1.6
	6.06 LTS dapper	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
squirrelmail	Debdiff: https://bugs.launchpad.net/ubuntu/+source/squirrelmail/+bug/598077

Severity score breakdown

Parameter	Value
Base score	6.5 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Other references

https://www.cve.org/CVERecord?id=CVE-2010-1637