Unrated severityNVD Advisory· Published May 14, 2009· Updated Jun 16, 2026
CVE-2009-1578
CVE-2009-1578
Description
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php; (2) PHP_SELF; and (3) the query string (aka QUERY_STRING).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
61cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*+ 59 more
- cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.0_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc2a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.15_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*
- (no CPE)range: <1.4.18
Patches
Vulnerability mechanics
References
32- squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/contrib/decrypt_headers.phpnvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLognvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/global.phpnvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmailnvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmailnvdPatch
- www.securityfocus.com/bid/34916nvdPatch
- www.squirrelmail.org/security/issue/2009-05-08nvdPatchVendor Advisory
- www.squirrelmail.org/security/issue/2009-05-09nvdPatchVendor Advisory
- www.vupen.com/english/advisories/2009/1296nvdPatchVendor Advisory
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.htmlnvdPatch
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.htmlnvdPatch
- www.mandriva.com/security/advisoriesnvdExploitPatch
- secunia.com/advisories/35052nvdVendor Advisory
- secunia.com/advisories/35073nvdVendor Advisory
- download.gna.org/nasmail/nasmail-1.7.zipnvd
- lists.apple.com/archives/security-announce/2010//Jun/msg00001.htmlnvd
- osvdb.org/60468nvd
- secunia.com/advisories/35140nvd
- secunia.com/advisories/35259nvd
- secunia.com/advisories/37415nvd
- secunia.com/advisories/40220nvd
- support.apple.com/kb/HT4188nvd
- www.debian.org/security/2009/dsa-1802nvd
- www.redhat.com/support/errata/RHSA-2009-1066.htmlnvd
- www.vupen.com/english/advisories/2009/3315nvd
- www.vupen.com/english/advisories/2010/1481nvd
- bugzilla.redhat.com/show_bug.cginvd
- exchange.xforce.ibmcloud.com/vulnerabilities/50459nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/50460nvd
- gna.org/forum/forum.phpnvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11624nvd
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.htmlnvd
News mentions
0No linked articles in our index yet.