CVE ID:	CVE-2006-4019
Description:	Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
Test IDs:	1.3.6.1.4.1.25623.1.0.57258   1.3.6.1.4.1.25623.1.0.59454   1.3.6.1.4.1.25623.1.0.57398   1.3.6.1.4.1.25623.1.0.57298   1.3.6.1.4.1.25623.1.0.62491   1.3.6.1.4.1.25623.1.0.59368
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2006-4019 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html BugTraq ID: 19486 http://www.securityfocus.com/bid/19486 BugTraq ID: 25159 http://www.securityfocus.com/bid/25159 Bugtraq: 20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack (Google Search) http://www.securityfocus.com/archive/1/442993/100/0/threaded Bugtraq: 20060811 rPSA-2006-0152-1 squirrelmail (Google Search) http://www.securityfocus.com/archive/1/442980/100/0/threaded Debian Security Information: DSA-1154 (Google Search) http://www.debian.org/security/2006/dsa-1154 http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147 http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch http://www.osvdb.org/27917 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533 RedHat Security Advisories: RHSA-2006:0668 http://www.redhat.com/support/errata/RHSA-2006-0668.html http://securitytracker.com/id?1016689 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http://secunia.com/advisories/22080 http://secunia.com/advisories/22104 http://secunia.com/advisories/22487 http://secunia.com/advisories/26235 SGI Security Advisory: 20061001-01-P ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc SuSE Security Announcement: SUSE-SR:2006:023 (Google Search) http://www.novell.com/linux/security/advisories/2006_23_sr.html http://attrition.org/pipermail/vim/2006-August/000970.html http://www.vupen.com/english/advisories/2006/3271 http://www.vupen.com/english/advisories/2007/2732 XForce ISS Database: squirrelmail-compose-variable-overwrite(28365) https://exchange.xforce.ibmcloud.com/vulnerabilities/28365