{
  "affected": [],
  "aliases": [
    "CVE-2006-4019"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-08-11T21:04:00Z",
    "severity": "MODERATE"
  },
  "details": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.",
  "id": "GHSA-hx28-58mx-whmj",
  "modified": "2022-05-03T03:16:18Z",
  "published": "2022-05-03T03:16:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
    },
    {
      "type": "WEB",
      "url": "https://issues.rpath.com/browse/RPL-577"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
    },
    {
      "type": "WEB",
      "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
    },
    {
      "type": "WEB",
      "url": "http://docs.info.apple.com/article.html?artnum=306172"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/21354"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/21444"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/21586"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22080"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22104"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22487"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/26235"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1016689"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2006/dsa-1154"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/27917"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/19486"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/25159"
    },
    {
      "type": "WEB",
      "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
    },
    {
      "type": "WEB",
      "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/3271"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/2732"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C179A3C-8C8C-429B-BACA-8ADAE4170465",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AD31177-05BB-4623-AED7-765DB7E44E47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "20247A22-9AB9-4BCE-BF28-350B52FBC62D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "79E6734C-EE1C-40B6-9759-15298707A6F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6733B8C-5A9E-45CE-8938-F39A69EB0DC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B08E51F1-3764-4146-89C1-20B9B8EE1222",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD4071B2-3D4F-4755-98B1-E28CEB05EA8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF6591E5-5F36-4663-85A6-9D870FD49FC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D062B70A-E5FF-403B-8BD1-777D6462B7CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D4CFD4D-EAC3-4325-A87F-9D5F4C513208",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A884536-4D27-4350-B815-AB4E625879DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7ED3CC3-E0A8-4C20-9EF7-405CD32E9EF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD89F143-EEBF-472D-9653-E7534F5799FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "442BF5C9-DC58-4A94-A634-33D6A4F3C6DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.44:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0C44025-C79D-4791-8EF6-3E26786E194E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de evaluaci\u00f3n de variable din\u00e1mica en compose.php en SquirrelMail 1.4.0 hasta la versi\u00f3n 1.4.7 permite a atacantes remotos sobreescribir variables del programa arbitrarias y leer o escribir los archivos adjuntos y preferencias de otros usuarios."
    }
  ],
  "evaluatorSolution": "This vulnerability is addressed in the following product release:\r\nSquirrelMail, SquirrelMail, 1.4.8",
  "id": "CVE-2006-4019",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-08-11T21:04:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://docs.info.apple.com/article.html?artnum=306172"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21354"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/21444"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/21586"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22080"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22104"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22487"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/26235"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1016689"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2006/dsa-1154"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/27917"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/19486"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/25159"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/3271"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/2732"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://issues.rpath.com/browse/RPL-577"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://docs.info.apple.com/article.html?artnum=306172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21354"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/21444"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/21586"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22080"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22104"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22487"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/26235"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1016689"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-1154"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/27917"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/19486"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/25159"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/3271"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2732"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.rpath.com/browse/RPL-577"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new squirrelmail package that fixes a security issue as well as several\nbugs is now available for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "SquirrelMail is a standards-based webmail package written in PHP.\n\nA dynamic variable evaluation flaw was found in SquirrelMail.  Users who\nhave an account on a SquirrelMail server and are logged in could use this\nflaw to overwrite variables which may allow them to read or write other\nusers\u0027 preferences or attachments.  (CVE-2006-4019)\n\nUsers of SquirrelMail should upgrade to this erratum package, which\ncontains SquirrelMail 1.4.8 to correct this issue.  This package also\ncontains a number of additional patches to correct various bugs.\n\nNote: After installing this update, users are advised to restart their httpd\nservice to ensure that the new version functions correctly.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2006:0668",
        "url": "https://access.redhat.com/errata/RHSA-2006:0668"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "192236",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=192236"
      },
      {
        "category": "external",
        "summary": "194457",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194457"
      },
      {
        "category": "external",
        "summary": "194598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194598"
      },
      {
        "category": "external",
        "summary": "194599",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194599"
      },
      {
        "category": "external",
        "summary": "195452",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=195452"
      },
      {
        "category": "external",
        "summary": "195639",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=195639"
      },
      {
        "category": "external",
        "summary": "196017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=196017"
      },
      {
        "category": "external",
        "summary": "196117",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=196117"
      },
      {
        "category": "external",
        "summary": "202195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=202195"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0668.json"
      }
    ],
    "title": "Red Hat Security Advisory: squirrelmail security update",
    "tracking": {
      "current_release_date": "2024-11-22T00:29:41+00:00",
      "generator": {
        "date": "2024-11-22T00:29:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2006:0668",
      "initial_release_date": "2006-09-26T12:26:00+00:00",
      "revision_history": [
        {
          "date": "2006-09-26T12:26:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2006-09-26T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T00:29:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 3",
                  "product_id": "3AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::as"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 3",
                "product": {
                  "name": "Red Hat Desktop version 3",
                  "product_id": "3Desktop",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 3",
                  "product_id": "3ES",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::es"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 3",
                  "product_id": "3WS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 4",
                  "product_id": "4AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::as"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop version 4",
                  "product_id": "4Desktop",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 4",
                  "product_id": "4ES",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::es"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 4",
                  "product_id": "4WS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el3.src",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el3.src",
                  "product_id": "squirrelmail-0:1.4.8-2.el3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el3?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el4.src",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el4.src",
                  "product_id": "squirrelmail-0:1.4.8-2.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el3.noarch",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el3.noarch",
                  "product_id": "squirrelmail-0:1.4.8-2.el3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el4.noarch",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el4.noarch",
                  "product_id": "squirrelmail-0:1.4.8-2.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux AS version 3",
          "product_id": "3AS:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux AS version 3",
          "product_id": "3AS:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Desktop version 3",
          "product_id": "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Desktop version 3",
          "product_id": "3Desktop:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux ES version 3",
          "product_id": "3ES:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux ES version 3",
          "product_id": "3ES:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux WS version 3",
          "product_id": "3WS:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux WS version 3",
          "product_id": "3WS:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux AS version 4",
          "product_id": "4AS:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux AS version 4",
          "product_id": "4AS:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux Desktop version 4",
          "product_id": "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux Desktop version 4",
          "product_id": "4Desktop:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux ES version 4",
          "product_id": "4ES:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux ES version 4",
          "product_id": "4ES:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux WS version 4",
          "product_id": "4WS:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux WS version 4",
          "product_id": "4WS:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4WS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2006-4019",
      "discovery_date": "2006-08-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1618173"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS:squirrelmail-0:1.4.8-2.el3.noarch",
          "3AS:squirrelmail-0:1.4.8-2.el3.src",
          "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch",
          "3Desktop:squirrelmail-0:1.4.8-2.el3.src",
          "3ES:squirrelmail-0:1.4.8-2.el3.noarch",
          "3ES:squirrelmail-0:1.4.8-2.el3.src",
          "3WS:squirrelmail-0:1.4.8-2.el3.noarch",
          "3WS:squirrelmail-0:1.4.8-2.el3.src",
          "4AS:squirrelmail-0:1.4.8-2.el4.noarch",
          "4AS:squirrelmail-0:1.4.8-2.el4.src",
          "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch",
          "4Desktop:squirrelmail-0:1.4.8-2.el4.src",
          "4ES:squirrelmail-0:1.4.8-2.el4.noarch",
          "4ES:squirrelmail-0:1.4.8-2.el4.src",
          "4WS:squirrelmail-0:1.4.8-2.el4.noarch",
          "4WS:squirrelmail-0:1.4.8-2.el4.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-4019"
        },
        {
          "category": "external",
          "summary": "RHBZ#1618173",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1618173"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-4019",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-4019"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019"
        }
      ],
      "release_date": "2006-08-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-09-26T12:26:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "3AS:squirrelmail-0:1.4.8-2.el3.noarch",
            "3AS:squirrelmail-0:1.4.8-2.el3.src",
            "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch",
            "3Desktop:squirrelmail-0:1.4.8-2.el3.src",
            "3ES:squirrelmail-0:1.4.8-2.el3.noarch",
            "3ES:squirrelmail-0:1.4.8-2.el3.src",
            "3WS:squirrelmail-0:1.4.8-2.el3.noarch",
            "3WS:squirrelmail-0:1.4.8-2.el3.src",
            "4AS:squirrelmail-0:1.4.8-2.el4.noarch",
            "4AS:squirrelmail-0:1.4.8-2.el4.src",
            "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch",
            "4Desktop:squirrelmail-0:1.4.8-2.el4.src",
            "4ES:squirrelmail-0:1.4.8-2.el4.noarch",
            "4ES:squirrelmail-0:1.4.8-2.el4.src",
            "4WS:squirrelmail-0:1.4.8-2.el4.noarch",
            "4WS:squirrelmail-0:1.4.8-2.el4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0668"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new squirrelmail package that fixes a security issue as well as several\nbugs is now available for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "SquirrelMail is a standards-based webmail package written in PHP.\n\nA dynamic variable evaluation flaw was found in SquirrelMail.  Users who\nhave an account on a SquirrelMail server and are logged in could use this\nflaw to overwrite variables which may allow them to read or write other\nusers\u0027 preferences or attachments.  (CVE-2006-4019)\n\nUsers of SquirrelMail should upgrade to this erratum package, which\ncontains SquirrelMail 1.4.8 to correct this issue.  This package also\ncontains a number of additional patches to correct various bugs.\n\nNote: After installing this update, users are advised to restart their httpd\nservice to ensure that the new version functions correctly.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2006:0668",
        "url": "https://access.redhat.com/errata/RHSA-2006:0668"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "192236",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=192236"
      },
      {
        "category": "external",
        "summary": "194457",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194457"
      },
      {
        "category": "external",
        "summary": "194598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194598"
      },
      {
        "category": "external",
        "summary": "194599",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194599"
      },
      {
        "category": "external",
        "summary": "195452",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=195452"
      },
      {
        "category": "external",
        "summary": "195639",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=195639"
      },
      {
        "category": "external",
        "summary": "196017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=196017"
      },
      {
        "category": "external",
        "summary": "196117",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=196117"
      },
      {
        "category": "external",
        "summary": "202195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=202195"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0668.json"
      }
    ],
    "title": "Red Hat Security Advisory: squirrelmail security update",
    "tracking": {
      "current_release_date": "2025-10-09T12:49:17+00:00",
      "generator": {
        "date": "2025-10-09T12:49:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2006:0668",
      "initial_release_date": "2006-09-26T12:26:00+00:00",
      "revision_history": [
        {
          "date": "2006-09-26T12:26:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2006-09-26T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T12:49:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 3",
                  "product_id": "3AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::as"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 3",
                "product": {
                  "name": "Red Hat Desktop version 3",
                  "product_id": "3Desktop",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 3",
                  "product_id": "3ES",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::es"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 3",
                  "product_id": "3WS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 4",
                  "product_id": "4AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::as"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop version 4",
                  "product_id": "4Desktop",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 4",
                  "product_id": "4ES",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::es"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 4",
                  "product_id": "4WS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el3.src",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el3.src",
                  "product_id": "squirrelmail-0:1.4.8-2.el3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el3?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el4.src",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el4.src",
                  "product_id": "squirrelmail-0:1.4.8-2.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el3.noarch",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el3.noarch",
                  "product_id": "squirrelmail-0:1.4.8-2.el3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el4.noarch",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el4.noarch",
                  "product_id": "squirrelmail-0:1.4.8-2.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux AS version 3",
          "product_id": "3AS:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux AS version 3",
          "product_id": "3AS:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Desktop version 3",
          "product_id": "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Desktop version 3",
          "product_id": "3Desktop:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux ES version 3",
          "product_id": "3ES:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux ES version 3",
          "product_id": "3ES:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux WS version 3",
          "product_id": "3WS:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux WS version 3",
          "product_id": "3WS:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux AS version 4",
          "product_id": "4AS:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux AS version 4",
          "product_id": "4AS:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux Desktop version 4",
          "product_id": "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux Desktop version 4",
          "product_id": "4Desktop:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux ES version 4",
          "product_id": "4ES:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux ES version 4",
          "product_id": "4ES:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux WS version 4",
          "product_id": "4WS:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux WS version 4",
          "product_id": "4WS:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4WS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2006-4019",
      "discovery_date": "2006-08-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1618173"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS:squirrelmail-0:1.4.8-2.el3.noarch",
          "3AS:squirrelmail-0:1.4.8-2.el3.src",
          "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch",
          "3Desktop:squirrelmail-0:1.4.8-2.el3.src",
          "3ES:squirrelmail-0:1.4.8-2.el3.noarch",
          "3ES:squirrelmail-0:1.4.8-2.el3.src",
          "3WS:squirrelmail-0:1.4.8-2.el3.noarch",
          "3WS:squirrelmail-0:1.4.8-2.el3.src",
          "4AS:squirrelmail-0:1.4.8-2.el4.noarch",
          "4AS:squirrelmail-0:1.4.8-2.el4.src",
          "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch",
          "4Desktop:squirrelmail-0:1.4.8-2.el4.src",
          "4ES:squirrelmail-0:1.4.8-2.el4.noarch",
          "4ES:squirrelmail-0:1.4.8-2.el4.src",
          "4WS:squirrelmail-0:1.4.8-2.el4.noarch",
          "4WS:squirrelmail-0:1.4.8-2.el4.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-4019"
        },
        {
          "category": "external",
          "summary": "RHBZ#1618173",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1618173"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-4019",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-4019"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019"
        }
      ],
      "release_date": "2006-08-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-09-26T12:26:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "3AS:squirrelmail-0:1.4.8-2.el3.noarch",
            "3AS:squirrelmail-0:1.4.8-2.el3.src",
            "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch",
            "3Desktop:squirrelmail-0:1.4.8-2.el3.src",
            "3ES:squirrelmail-0:1.4.8-2.el3.noarch",
            "3ES:squirrelmail-0:1.4.8-2.el3.src",
            "3WS:squirrelmail-0:1.4.8-2.el3.noarch",
            "3WS:squirrelmail-0:1.4.8-2.el3.src",
            "4AS:squirrelmail-0:1.4.8-2.el4.noarch",
            "4AS:squirrelmail-0:1.4.8-2.el4.src",
            "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch",
            "4Desktop:squirrelmail-0:1.4.8-2.el4.src",
            "4ES:squirrelmail-0:1.4.8-2.el4.noarch",
            "4ES:squirrelmail-0:1.4.8-2.el4.src",
            "4WS:squirrelmail-0:1.4.8-2.el4.noarch",
            "4WS:squirrelmail-0:1.4.8-2.el4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0668"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new squirrelmail package that fixes a security issue as well as several\nbugs is now available for Red Hat Enterprise Linux 3 and 4.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "SquirrelMail is a standards-based webmail package written in PHP.\n\nA dynamic variable evaluation flaw was found in SquirrelMail.  Users who\nhave an account on a SquirrelMail server and are logged in could use this\nflaw to overwrite variables which may allow them to read or write other\nusers\u0027 preferences or attachments.  (CVE-2006-4019)\n\nUsers of SquirrelMail should upgrade to this erratum package, which\ncontains SquirrelMail 1.4.8 to correct this issue.  This package also\ncontains a number of additional patches to correct various bugs.\n\nNote: After installing this update, users are advised to restart their httpd\nservice to ensure that the new version functions correctly.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2006:0668",
        "url": "https://access.redhat.com/errata/RHSA-2006:0668"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "192236",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=192236"
      },
      {
        "category": "external",
        "summary": "194457",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194457"
      },
      {
        "category": "external",
        "summary": "194598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194598"
      },
      {
        "category": "external",
        "summary": "194599",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=194599"
      },
      {
        "category": "external",
        "summary": "195452",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=195452"
      },
      {
        "category": "external",
        "summary": "195639",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=195639"
      },
      {
        "category": "external",
        "summary": "196017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=196017"
      },
      {
        "category": "external",
        "summary": "196117",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=196117"
      },
      {
        "category": "external",
        "summary": "202195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=202195"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0668.json"
      }
    ],
    "title": "Red Hat Security Advisory: squirrelmail security update",
    "tracking": {
      "current_release_date": "2025-10-09T12:49:17+00:00",
      "generator": {
        "date": "2025-10-09T12:49:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2006:0668",
      "initial_release_date": "2006-09-26T12:26:00+00:00",
      "revision_history": [
        {
          "date": "2006-09-26T12:26:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2006-09-26T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T12:49:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 3",
                  "product_id": "3AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::as"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 3",
                "product": {
                  "name": "Red Hat Desktop version 3",
                  "product_id": "3Desktop",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 3",
                  "product_id": "3ES",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::es"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 3",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 3",
                  "product_id": "3WS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 4",
                  "product_id": "4AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::as"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop version 4",
                  "product_id": "4Desktop",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 4",
                  "product_id": "4ES",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::es"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 4",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 4",
                  "product_id": "4WS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el3.src",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el3.src",
                  "product_id": "squirrelmail-0:1.4.8-2.el3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el3?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el4.src",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el4.src",
                  "product_id": "squirrelmail-0:1.4.8-2.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el3.noarch",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el3.noarch",
                  "product_id": "squirrelmail-0:1.4.8-2.el3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el3?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "squirrelmail-0:1.4.8-2.el4.noarch",
                "product": {
                  "name": "squirrelmail-0:1.4.8-2.el4.noarch",
                  "product_id": "squirrelmail-0:1.4.8-2.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/squirrelmail@1.4.8-2.el4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux AS version 3",
          "product_id": "3AS:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux AS version 3",
          "product_id": "3AS:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Desktop version 3",
          "product_id": "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Desktop version 3",
          "product_id": "3Desktop:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux ES version 3",
          "product_id": "3ES:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux ES version 3",
          "product_id": "3ES:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.noarch as a component of Red Hat Enterprise Linux WS version 3",
          "product_id": "3WS:squirrelmail-0:1.4.8-2.el3.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.noarch",
        "relates_to_product_reference": "3WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el3.src as a component of Red Hat Enterprise Linux WS version 3",
          "product_id": "3WS:squirrelmail-0:1.4.8-2.el3.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el3.src",
        "relates_to_product_reference": "3WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux AS version 4",
          "product_id": "4AS:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux AS version 4",
          "product_id": "4AS:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4AS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux Desktop version 4",
          "product_id": "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux Desktop version 4",
          "product_id": "4Desktop:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4Desktop"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux ES version 4",
          "product_id": "4ES:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux ES version 4",
          "product_id": "4ES:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4ES"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.noarch as a component of Red Hat Enterprise Linux WS version 4",
          "product_id": "4WS:squirrelmail-0:1.4.8-2.el4.noarch"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.noarch",
        "relates_to_product_reference": "4WS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "squirrelmail-0:1.4.8-2.el4.src as a component of Red Hat Enterprise Linux WS version 4",
          "product_id": "4WS:squirrelmail-0:1.4.8-2.el4.src"
        },
        "product_reference": "squirrelmail-0:1.4.8-2.el4.src",
        "relates_to_product_reference": "4WS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2006-4019",
      "discovery_date": "2006-08-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1618173"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS:squirrelmail-0:1.4.8-2.el3.noarch",
          "3AS:squirrelmail-0:1.4.8-2.el3.src",
          "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch",
          "3Desktop:squirrelmail-0:1.4.8-2.el3.src",
          "3ES:squirrelmail-0:1.4.8-2.el3.noarch",
          "3ES:squirrelmail-0:1.4.8-2.el3.src",
          "3WS:squirrelmail-0:1.4.8-2.el3.noarch",
          "3WS:squirrelmail-0:1.4.8-2.el3.src",
          "4AS:squirrelmail-0:1.4.8-2.el4.noarch",
          "4AS:squirrelmail-0:1.4.8-2.el4.src",
          "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch",
          "4Desktop:squirrelmail-0:1.4.8-2.el4.src",
          "4ES:squirrelmail-0:1.4.8-2.el4.noarch",
          "4ES:squirrelmail-0:1.4.8-2.el4.src",
          "4WS:squirrelmail-0:1.4.8-2.el4.noarch",
          "4WS:squirrelmail-0:1.4.8-2.el4.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-4019"
        },
        {
          "category": "external",
          "summary": "RHBZ#1618173",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1618173"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-4019",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-4019"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4019"
        }
      ],
      "release_date": "2006-08-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-09-26T12:26:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "3AS:squirrelmail-0:1.4.8-2.el3.noarch",
            "3AS:squirrelmail-0:1.4.8-2.el3.src",
            "3Desktop:squirrelmail-0:1.4.8-2.el3.noarch",
            "3Desktop:squirrelmail-0:1.4.8-2.el3.src",
            "3ES:squirrelmail-0:1.4.8-2.el3.noarch",
            "3ES:squirrelmail-0:1.4.8-2.el3.src",
            "3WS:squirrelmail-0:1.4.8-2.el3.noarch",
            "3WS:squirrelmail-0:1.4.8-2.el3.src",
            "4AS:squirrelmail-0:1.4.8-2.el4.noarch",
            "4AS:squirrelmail-0:1.4.8-2.el4.src",
            "4Desktop:squirrelmail-0:1.4.8-2.el4.noarch",
            "4Desktop:squirrelmail-0:1.4.8-2.el4.src",
            "4ES:squirrelmail-0:1.4.8-2.el4.noarch",
            "4ES:squirrelmail-0:1.4.8-2.el4.src",
            "4WS:squirrelmail-0:1.4.8-2.el4.noarch",
            "4WS:squirrelmail-0:1.4.8-2.el4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0668"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apple Mac OS X Server v10.3.9 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac OS X Server v10.4.10.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac OS X v10.4.10 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac OS X v10.3.9 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le syst\u00e8me\nd\u0027exploitation Mac OS X. Parmi celles-ci :\n\n-   bzip2 : un nom d\u0027archive malicieusement form\u00e9 permet l\u0027ex\u00e9cution de\n    code arbitraire \u00e0 distance ;\n-   CFNetwork : un clic sur une addresse malicieusement form\u00e9e permet\n    l\u0027ex\u00e9cution de commandes FTP arbitraires \u00e0 distance ;\n-   CoreAudio : une page Web malicieusement cr\u00e9\u00e9e permet \u00e0 l\u0027aide d\u0027une\n    applet Java d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance;\n-   cscope : des vuln\u00e9rabilit\u00e9s concernant un d\u00e9passement de m\u00e9moire et\n    la cr\u00e9ation de fichiers temporaires dangereux ont \u00e9t\u00e9 corrig\u00e9es ;\n-   gnuzip : un nom d\u0027archive malicieusement form\u00e9 permet l\u0027ex\u00e9cution de\n    code arbitraire \u00e0 distance ;\n-   iChat : un d\u00e9passement de m\u00e9moire permet de provoquer un d\u00e9ni de\n    service \u00e0 distance ou l\u0027ex\u00e9cution de code arbitraire \u00e0 distance au\n    sein d\u0027un m\u00eame sous r\u00e9seau ;\n-   Kerberos : des vuln\u00e9rabilit\u00e9s pouvant provoquer un d\u00e9ni de service\n    ou l\u0027ex\u00e9cution de code arbitraire \u00e0 distance ont \u00e9t\u00e9 corrig\u00e9es ;\n-   mDNSResponder : un d\u00e9passement de m\u00e9moire permet de provoquer un\n    d\u00e9ni de service \u00e0 distance ou l\u0027ex\u00e9cution de code arbitraire \u00e0\n    distance au sein d\u0027un m\u00eame sous r\u00e9seau ;\n-   PDFKit : l\u0027ouverture d\u0027un document malicieusement cr\u00e9\u00e9 permet un\n    d\u00e9ni de service de l\u0027application ou l\u0027ex\u00e9cution de code arbitraire ;\n-   PHP : plusieurs vuln\u00e9rabilit\u00e9s touchant PHP 4.4.4 ont \u00e9t\u00e9 corrig\u00e9es\n    ;\n-   Quartz Composer : l\u0027ouverture d\u0027un fichier Quartz malicieusement\n    cr\u00e9\u00e9 permet un d\u00e9ni de service de l\u0027application ou l\u0027ex\u00e9cution de\n    code arbitraire ;\n-   Samba : lorsque le partage de fichiers Windows est activ\u00e9, un\n    utilisateur non authentifi\u00e9 peut, \u00e0 distance, provoquer un d\u00e9ni de\n    service, ex\u00e9cuter du code ou des commandes arbitraires et contourner\n    la politique de s\u00e9curit\u00e9 ;\n-   SquirrelMail : plusieurs vuln\u00e9rabilit\u00e9s dont au moins une permettant\n    une attaque de type cross-site scripting ont \u00e9t\u00e9 corrig\u00e9es ;\n-   Tomcat : plusieurs vuln\u00e9rabilit\u00e9s dont certaines permettant des\n    attaques de type cross-site scripting et l\u0027atteinte \u00e0 la\n    confidentialit\u00e9 des donn\u00e9es ont \u00e9t\u00e9 corrig\u00e9es ;\n-   WebCore : des vuln\u00e9rabilit\u00e9s permettant l\u0027ex\u00e9cution d\u0027applets Java\n    alors que celui-ci est d\u00e9sactiv\u00e9 et permettant la r\u00e9alisation\n    d\u0027attaques de type cross-site scripting ont \u00e9t\u00e9 corrig\u00e9es ;\n-   WebKit : l\u0027ouverture d\u0027une page Web malicieusement cr\u00e9\u00e9e permet\n    l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2005-0758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-0758"
    },
    {
      "name": "CVE-2007-2403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2403"
    },
    {
      "name": "CVE-2007-1583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1583"
    },
    {
      "name": "CVE-2007-2407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2407"
    },
    {
      "name": "CVE-2006-2842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-2842"
    },
    {
      "name": "CVE-2007-0450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0450"
    },
    {
      "name": "CVE-2007-1711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1711"
    },
    {
      "name": "CVE-2007-2409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2409"
    },
    {
      "name": "CVE-2007-2405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2405"
    },
    {
      "name": "CVE-2007-3944",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3944"
    },
    {
      "name": "CVE-2007-1287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1287"
    },
    {
      "name": "CVE-2007-1262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1262"
    },
    {
      "name": "CVE-2007-2408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2408"
    },
    {
      "name": "CVE-2005-3128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-3128"
    },
    {
      "name": "CVE-2007-1521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1521"
    },
    {
      "name": "CVE-2007-2446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2446"
    },
    {
      "name": "CVE-2007-1358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1358"
    },
    {
      "name": "CVE-2007-1717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1717"
    },
    {
      "name": "CVE-2005-2090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-2090"
    },
    {
      "name": "CVE-2007-1001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1001"
    },
    {
      "name": "CVE-2007-0478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0478"
    },
    {
      "name": "CVE-2006-3174",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3174"
    },
    {
      "name": "CVE-2007-3747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3747"
    },
    {
      "name": "CVE-2007-2406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2406"
    },
    {
      "name": "CVE-2007-3748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3748"
    },
    {
      "name": "CVE-2007-2442",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2442"
    },
    {
      "name": "CVE-2007-3744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3744"
    },
    {
      "name": "CVE-2007-3745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3745"
    },
    {
      "name": "CVE-2007-1460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1460"
    },
    {
      "name": "CVE-2007-2410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2410"
    },
    {
      "name": "CVE-2004-0996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2004-0996"
    },
    {
      "name": "CVE-2006-6142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6142"
    },
    {
      "name": "CVE-2007-1860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1860"
    },
    {
      "name": "CVE-2007-2798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2798"
    },
    {
      "name": "CVE-2007-1461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1461"
    },
    {
      "name": "CVE-2007-3742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3742"
    },
    {
      "name": "CVE-2004-2541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2004-2541"
    },
    {
      "name": "CVE-2007-2404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2404"
    },
    {
      "name": "CVE-2007-2447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2447"
    },
    {
      "name": "CVE-2007-1484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1484"
    },
    {
      "name": "CVE-2006-4019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4019"
    },
    {
      "name": "CVE-2007-2589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2589"
    },
    {
      "name": "CVE-2007-2443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2443"
    },
    {
      "name": "CVE-2007-3746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3746"
    }
  ],
  "initial_release_date": "2007-08-01T00:00:00",
  "last_revision_date": "2007-08-01T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 2007-007 306172 du 30 juillet    2007 :",
      "url": "http://docs.info.apple.com/article.html?artnum=306172"
    }
  ],
  "reference": "CERTA-2007-AVI-340",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-08-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es : elles concernent le\nsyst\u00e8me d\u0027exploitation Mac OS X. L\u0027exploitation de ces derni\u00e8res peut\navoir des cons\u00e9quences vari\u00e9es, comme l\u0027ex\u00e9cution de code arbitraire, ou\nun dysfonctionnement du syst\u00e8me vuln\u00e9rable.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Mac OS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 Apple 2007-007 306172 du 30 juillet 2007",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eLes versions de SquirrelMail comprises entre 1.4.0 et 1.4.7  (incluses).\u003c/P\u003e",
  "content": "## Description\n\nSquirrelMail est un outil de webmail \u00e9crit en PHP4, et permettant\nd\u0027int\u00e9ragir avec les protocoles IMAP et SMTP. Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9\nidentifi\u00e9e dans la fonction compose.php. Cette derni\u00e8re permet de\nrestaurer le message en cours d\u0027\u00e9criture quand la session de\nl\u0027utilisateur expire.\n\nUne personne malveillante authentifi\u00e9e sur le syst\u00e8me peut profiter de\ncette vuln\u00e9rabilit\u00e9 pour lire ou \u00e9crire dans certaines variables, et\nainsi acc\u00e9der \u00e0 certaines options de l\u0027utilisateur ou \u00e0 des documents\nstock\u00e9s en pi\u00e8ce jointe.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4019"
    }
  ],
  "initial_release_date": "2006-08-11T00:00:00",
  "last_revision_date": "2006-09-28T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 du 11 ao\u00fbt 2006 de SquirrelMail :",
      "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD :",
      "url": "http://www.vuxml.org/freebd/index.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE SUSE-SA:2006:023 du 27 septembre    2006 :",
      "url": "http://lists.suse.com/archive/suse-security-announce/2006-Sep/0011.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2006:0668 du 25 septembre    2006 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0668.html"
    },
    {
      "title": "Site officiel du projet SquirrelMail :",
      "url": "http://www.squirrelmail.org"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1154 du 20 ao\u00fbt 2006 :",
      "url": "http://www.debian.org/security/2006/dsa-1154"
    }
  ],
  "reference": "CERTA-2006-AVI-351",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2006-08-11T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de s\u00e9curit\u00e9 FreeBSD ;",
      "revision_date": "2006-08-17T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de s\u00e9curit\u00e9 Debian.",
      "revision_date": "2006-08-23T00:00:00.000000"
    },
    {
      "description": "ajout des bulletins de s\u00e9curit\u00e9 SuSE et Red Hat.",
      "revision_date": "2006-09-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 de SquirrelMail",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 du projet SquirrelMail",
      "url": null
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2006-4019",
    "description": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.",
    "id": "GSD-2006-4019",
    "references": [
      "https://www.suse.com/security/cve/CVE-2006-4019.html",
      "https://www.debian.org/security/2006/dsa-1154",
      "https://access.redhat.com/errata/RHSA-2006:0668",
      "https://linux.oracle.com/cve/CVE-2006-4019.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-4019"
      ],
      "details": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.",
      "id": "GSD-2006-4019",
      "modified": "2023-12-13T01:19:51.457181Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2006-4019",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "21586",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/21586"
          },
          {
            "name": "https://issues.rpath.com/browse/RPL-577",
            "refsource": "CONFIRM",
            "url": "https://issues.rpath.com/browse/RPL-577"
          },
          {
            "name": "ADV-2007-2732",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2007/2732"
          },
          {
            "name": "DSA-1154",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2006/dsa-1154"
          },
          {
            "name": "21354",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/21354"
          },
          {
            "name": "22487",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22487"
          },
          {
            "name": "1016689",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1016689"
          },
          {
            "name": "SUSE-SR:2006:023",
            "refsource": "SUSE",
            "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
          },
          {
            "name": "APPLE-SA-2007-07-31",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
          },
          {
            "name": "ADV-2006-3271",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/3271"
          },
          {
            "name": "21444",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/21444"
          },
          {
            "name": "squirrelmail-compose-variable-overwrite(28365)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
          },
          {
            "name": "22080",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22080"
          },
          {
            "name": "20060811 SquirrelMail issue is dynamic variable evaluation",
            "refsource": "VIM",
            "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
          },
          {
            "name": "19486",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/19486"
          },
          {
            "name": "RHSA-2006:0668",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
          },
          {
            "name": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch",
            "refsource": "MISC",
            "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
          },
          {
            "name": "http://www.squirrelmail.org/security/issue/2006-08-11",
            "refsource": "CONFIRM",
            "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
          },
          {
            "name": "22104",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22104"
          },
          {
            "name": "20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
          },
          {
            "name": "20060811 rPSA-2006-0152-1 squirrelmail",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
          },
          {
            "name": "20060811 rPSA-2006-0152-1 squirrelmail",
            "refsource": "FULLDISC",
            "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
          },
          {
            "name": "27917",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/27917"
          },
          {
            "name": "oval:org.mitre.oval:def:11533",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
          },
          {
            "name": "http://docs.info.apple.com/article.html?artnum=306172",
            "refsource": "CONFIRM",
            "url": "http://docs.info.apple.com/article.html?artnum=306172"
          },
          {
            "name": "25159",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/25159"
          },
          {
            "name": "20061001-01-P",
            "refsource": "SGI",
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
          },
          {
            "name": "MDKSA-2006:147",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
          },
          {
            "name": "26235",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/26235"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4_rc1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:squirrelmail:squirrelmail:1.44:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4019"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.squirrelmail.org/security/issue/2006-08-11",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://www.squirrelmail.org/security/issue/2006-08-11"
            },
            {
              "name": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch"
            },
            {
              "name": "21354",
              "refsource": "SECUNIA",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/21354"
            },
            {
              "name": "20060811 SquirrelMail issue is dynamic variable evaluation",
              "refsource": "VIM",
              "tags": [],
              "url": "http://attrition.org/pipermail/vim/2006-August/000970.html"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-577",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://issues.rpath.com/browse/RPL-577"
            },
            {
              "name": "19486",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/19486"
            },
            {
              "name": "27917",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/27917"
            },
            {
              "name": "1016689",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1016689"
            },
            {
              "name": "21444",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/21444"
            },
            {
              "name": "DSA-1154",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2006/dsa-1154"
            },
            {
              "name": "21586",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/21586"
            },
            {
              "name": "RHSA-2006:0668",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0668.html"
            },
            {
              "name": "SUSE-SR:2006:023",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://www.novell.com/linux/security/advisories/2006_23_sr.html"
            },
            {
              "name": "22104",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22104"
            },
            {
              "name": "20061001-01-P",
              "refsource": "SGI",
              "tags": [],
              "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
            },
            {
              "name": "22487",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22487"
            },
            {
              "name": "22080",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22080"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306172",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://docs.info.apple.com/article.html?artnum=306172"
            },
            {
              "name": "APPLE-SA-2007-07-31",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
            },
            {
              "name": "MDKSA-2006:147",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:147"
            },
            {
              "name": "25159",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/25159"
            },
            {
              "name": "26235",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/26235"
            },
            {
              "name": "ADV-2007-2732",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2007/2732"
            },
            {
              "name": "ADV-2006-3271",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/3271"
            },
            {
              "name": "20060811 rPSA-2006-0152-1 squirrelmail",
              "refsource": "FULLDISC",
              "tags": [],
              "url": "http://marc.info/?l=full-disclosure\u0026m=115532449024178\u0026w=2"
            },
            {
              "name": "squirrelmail-compose-variable-overwrite(28365)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28365"
            },
            {
              "name": "oval:org.mitre.oval:def:11533",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533"
            },
            {
              "name": "20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/442993/100/0/threaded"
            },
            {
              "name": "20060811 rPSA-2006-0152-1 squirrelmail",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/442980/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-17T21:32Z",
      "publishedDate": "2006-08-11T21:04Z"
    }
  }
}