CVE-2009-1381
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian...
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
Exploit likelihood
What each source reports
NVD Score used
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
- Record
CVE-2009-1381- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
- Record
CVE-2009-1381- Updated
- 2026-11-02
EUVDEUVD-2009-1379 No score
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
- Record
EUVD-2009-1379- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qmxf-cchc-q3mc No score
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian...
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
- Record
GHSA-qmxf-cchc-q3mc- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squirrelmailDebian:4.0 |
before 2:1.4.9a-5, plus listed versions 2:1.4.9a-12:1.4.9a-22:1.4.9a-32:1.4.9a-4 |
2:1.4.9a-5 |
squirrelmailDebian:5.0 |
before 2:1.4.15-4+lenny2, plus listed versions 2:1.4.15-42:1.4.15-4+lenny1 |
2:1.4.15-4+lenny2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1381 is a medium vulnerability (CVSS 6.8) in Squirrelmail, published May 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in squirrelmail 2:1.4.9a-5.
References
secunia.com/advisories/35140
redhat.com/archives/fedora-package-announce/2009-May/msg01202.html
securityfocus.com/archive/1/503718/100/0/threaded
mandriva.com/security/advisories?name=MDVSA-2009:122
release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff