CVE-2011-2752: Code Injection
Published Jul 17, 2011
·Updated
CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.
Affected Software
91 affected components
Squirrelmail Squirrelmail=1.3.1
Squirrelmail Squirrelmail=1.4.2
Squirrelmail Squirrelmail=0.4
Squirrelmail Squirrelmail=1.0.6
Squirrelmail Squirrelmail=1.0.5
Squirrelmail Squirrelmail=0.3
Squirrelmail Squirrelmail=0.4pre2
Squirrelmail Squirrelmail=1.4.17
Squirrelmail Squirrelmail=1.2.0-rc3
Squirrelmail Squirrelmail=1.1.0
Squirrelmail Squirrelmail=1.0pre2
Squirrelmail Squirrelmail=0.3.1
Squirrelmail Squirrelmail=1.4.19
Squirrelmail Squirrelmail=1.4.0-r1
Squirrelmail Squirrelmail=0.1.2
Squirrelmail Squirrelmail=1.2.7
Squirrelmail Squirrelmail=1.2.6-rc1
Squirrelmail Squirrelmail=1.4.13
Squirrelmail Squirrelmail=1.0.1
Squirrelmail Squirrelmail=0.2.1
Squirrelmail Squirrelmail=1.4.12
Squirrelmail Squirrelmail=1.4.9a
Squirrelmail Squirrelmail=1.4.6
Squirrelmail Squirrelmail=1.4.3-r3
Squirrelmail Squirrelmail=1.2.0
Squirrelmail Squirrelmail=1.4.7
Squirrelmail Squirrelmail=1.2.9
Squirrelmail Squirrelmail=0.1
Squirrelmail Squirrelmail=1.4.15
Squirrelmail Squirrelmail=1.2.2
Squirrelmail Squirrelmail=0.5pre2
Squirrelmail Squirrelmail=1.4.2-r3
Squirrelmail Squirrelmail=1.1.1
Squirrelmail Squirrelmail=1.4.16
Squirrelmail Squirrelmail=1.4-rc1
Squirrelmail Squirrelmail=1.1.2
Squirrelmail Squirrelmail=1.4.2-r5
Squirrelmail Squirrelmail=1.4.4-rc1
Squirrelmail Squirrelmail=1.4.15rc1
Squirrelmail Squirrelmail=0.3pre2
Squirrelmail Squirrelmail=1.4.3
Squirrelmail Squirrelmail=0.1.1
Squirrelmail Squirrelmail=1.3.2
Squirrelmail Squirrelmail=1.4.3-rc1
Squirrelmail Squirrelmail=1.2.1
Squirrelmail Squirrelmail=1.4.1
Squirrelmail Squirrelmail=1.4.9
Squirrelmail Squirrelmail=1.2
Squirrelmail Squirrelmail=1.4.20
Squirrelmail Squirrelmail=1.4.8
Squirrelmail Squirrelmail=1.4.6_cvs
Squirrelmail Squirrelmail=1.4.0
Squirrelmail Squirrelmail=1.4.0-rc1
Squirrelmail Squirrelmail=1.4
Squirrelmail Squirrelmail=1.1.3
Squirrelmail Squirrelmail=1.4.0-rc2a
Squirrelmail Squirrelmail=1.2.4
Squirrelmail Squirrelmail=0.5pre1
Squirrelmail Squirrelmail=1.4.5-rc1
Squirrelmail Squirrelmail=1.2.3
Squirrelmail Squirrelmail=1.4.10
Squirrelmail Squirrelmail=1.4.3a
Squirrelmail Squirrelmail=1.4.2-r1
Squirrelmail Squirrelmail=1.0.2
Squirrelmail Squirrelmail=1.0.4
Squirrelmail Squirrelmail=1.4.6-rc1
Squirrelmail Squirrelmail=1.0pre1
Squirrelmail Squirrelmail=1.2.6
Squirrelmail Squirrelmail=1.4.15-rc1
Squirrelmail Squirrelmail=1.4.2-r2
Squirrelmail Squirrelmail=1.4.8.4fc6
Squirrelmail Squirrelmail=1.4.10a
Squirrelmail Squirrelmail=1.4.4
Squirrelmail Squirrelmail=1.4.2-r4
Squirrelmail Squirrelmail=1.4.18
Squirrelmail Squirrelmail=1.4.3aa
Squirrelmail Squirrelmail=0.3pre1
Squirrelmail Squirrelmail=1.2.10
Squirrelmail Squirrelmail<=1.4.21
Squirrelmail Squirrelmail=0.4pre1
Squirrelmail Squirrelmail=1.2.5
Squirrelmail Squirrelmail=1.4.11
Squirrelmail Squirrelmail=1.0.3
Squirrelmail Squirrelmail=1.3.0
Squirrelmail Squirrelmail=1.0
Squirrelmail Squirrelmail=0.2
Squirrelmail Squirrelmail=1.2.8
Squirrelmail Squirrelmail=1.2.11
Squirrelmail Squirrelmail=0.5
Squirrelmail Squirrelmail=1.4.5
Squirrelmail Squirrelmail=1.0pre3
Remediation
Patch Available
Event History
Jul 17, 2011
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-2752?
CVE-2011-2752 is considered a medium severity vulnerability that can lead to CRLF injection.
2
How do I fix CVE-2011-2752?
To fix CVE-2011-2752, upgrade your SquirrelMail version to at least 1.4.22 or later.
3
Which versions of SquirrelMail are affected by CVE-2011-2752?
CVE-2011-2752 affects SquirrelMail versions 1.4.21 and earlier.
4
What is a CRLF injection vulnerability as described in CVE-2011-2752?
A CRLF injection vulnerability allows an attacker to insert CRLF sequences, potentially altering HTTP responses or headers.
5
Can CVE-2011-2752 be exploited remotely?
Yes, CVE-2011-2752 can be exploited remotely, allowing attackers to modify or add preference values.