It was reported that SquirrelMail did not implement protections against cross-site request forgery (CSRF) attacks. This can be exploited to e.g. change user preferences, delete emails, and potentially send emails when a logged-in user visits a malicious web page.
Upstream advisory: http://www.squirrelmail.org/security/issue/2009-08-12
Upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Issue was first addressed in 1.4.20RC1.
Secunia advisory: http://secunia.com/advisories/34627/
It was discovered that original upstream patch for server-side command execution flaw affecting setups with mapypalias username map enabled did not address the issue completely, due to incorrect use of quoting (backticks vs. single quotes). Code execution was still possible in upstream version 1.4.18.
Issue was fixed upstream in 1.4.19.
Updated upstream security advisory: http://www.squirrelmail.org/security/issue/2009-05-10
Full upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka optionsorder) page, a different issue than CVE-2010-4555.
CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.
An cross-site scripting (XSS) flaw was found in the way SquirrelMail performed sanitization of MIME messages containing certain <style> HTML tags. A remote attacker could provide a specially-crafted message, which once opened in SquirrelMail webmail client could lead to arbitrary JavaScript or HTML code execution.
Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-10
Relevant patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14121