CVE-2006-4019

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-08-11 · updated 2026-06-16

Description

Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.

Affected products

SquirrelMail: 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.3_r3, 1.4.3_rc1 (+9)

References

http://attrition.org/pipermail/vim/2006-August/000970.html
http://docs.info.apple.com/article.html?artnum=306172
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://marc.info/?l=full-disclosure&m=115532449024178&w=2
http://secunia.com/advisories/21354
http://secunia.com/advisories/21444
http://secunia.com/advisories/21586
http://secunia.com/advisories/22080
http://secunia.com/advisories/22104
http://secunia.com/advisories/22487
http://secunia.com/advisories/26235

Get alerted when CVE-2006-4019 or the next vulnerability affects your stack