CVE-2009-1381

The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

• http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiffExploit, Vendor Advisory
• http://secunia.com/advisories/35140Vendor Advisory
• http://www.debian.org/security/2009/dsa-1802Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:122
• http://www.securityfocus.com/archive/1/503718/100/0/threaded
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html
• http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiffExploit, Vendor Advisory
• http://secunia.com/advisories/35140Vendor Advisory
• http://www.debian.org/security/2009/dsa-1802Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:122
• http://www.securityfocus.com/archive/1/503718/100/0/threaded
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html

Published

May 22, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1375The PurpleCircBuffer implementation in Pidgin (formerly Gaim…
• CVE-2009-1376Multiple integer overflows in the msn_slplink_process_msg fu…
• CVE-2009-1377The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL …
• CVE-2009-1378Multiple memory leaks in the dtls1_process_out_of_seq_messag…
• CVE-2009-1379Use-after-free vulnerability in the dtls1_retrieve_buffered_…
• CVE-2009-1380Cross-site scripting (XSS) vulnerability in JMX-Console in J…
• CVE-2009-1382Multiple stack-based buffer overflows in mimetex.cgi in mime…
• CVE-2009-1383The getdirective function in mathtex.cgi in mathTeX, when do…
• CVE-2009-1384pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise…
• CVE-2009-1385Integer underflow in the e1000_clean_rx_irq function in driv…
• CVE-2009-1386ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attacker…
• CVE-2009-1387The dtls1_retrieve_buffered_fragment function in ssl/d1_both…