CVE-2009-2964

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.

• CWE-352

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
• http://download.gna.org/nasmail/nasmail-1.7.zip
• http://jvn.jp/en/jp/JVN30881447/index.html
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html
• http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
• http://osvdb.org/60469
• http://secunia.com/advisories/34627Vendor Advisory
• http://secunia.com/advisories/36363Vendor Advisory
• http://secunia.com/advisories/37415
• http://secunia.com/advisories/40220
• http://secunia.com/advisories/40964
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=13818&view=markup&pathrev=13818Patch
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818Patch
• http://support.apple.com/kb/HT4188
• http://www.debian.org/security/2010/dsa-2091
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:222
• http://www.osvdb.org/57001
• http://www.securityfocus.com/bid/36196
• http://www.squirrelmail.org/security/issue/2009-08-12Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2262Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/3315
• http://www.vupen.com/english/advisories/2010/1481
• http://www.vupen.com/english/advisories/2010/2080
• https://bugzilla.redhat.com/show_bug.cgi?id=517312Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52406
• https://gna.org/forum/forum.php?forum_id=2146
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10668
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00927.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00954.html
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
• http://download.gna.org/nasmail/nasmail-1.7.zip
• http://jvn.jp/en/jp/JVN30881447/index.html
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html
• http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
• http://osvdb.org/60469
• http://secunia.com/advisories/34627Vendor Advisory
• http://secunia.com/advisories/36363Vendor Advisory
• http://secunia.com/advisories/37415
• http://secunia.com/advisories/40220
• http://secunia.com/advisories/40964
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=13818&view=markup&pathrev=13818Patch
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818Patch
• http://support.apple.com/kb/HT4188
• http://www.debian.org/security/2010/dsa-2091
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:222
• http://www.osvdb.org/57001
• http://www.securityfocus.com/bid/36196
• http://www.squirrelmail.org/security/issue/2009-08-12Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2262Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/3315
• http://www.vupen.com/english/advisories/2010/1481
• http://www.vupen.com/english/advisories/2010/2080
• https://bugzilla.redhat.com/show_bug.cgi?id=517312Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52406
• https://gna.org/forum/forum.php?forum_id=2146
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10668
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00927.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00954.html

Published

Aug 25, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2958The tftp_request function in tftp.c in dnsmasq before 2.50, …
• CVE-2009-2959Cross-site scripting (XSS) vulnerability in the waterfall we…
• CVE-2009-2960CuteFlow 2.10.3 and 2.11.0_c does not properly restrict acce…
• CVE-2009-2961Stack-based buffer overflow in Thaddy de Konng KOL Player 1.…
• CVE-2009-2962Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-2963Unspecified vulnerability in the update feature in Toolbar U…
• CVE-2009-2965Cross-site scripting (XSS) vulnerability in entry/index.jsp …
• CVE-2009-2966avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Vi…
• CVE-2009-2967Multiple cross-site scripting (XSS) vulnerabilities in Build…
• CVE-2009-2968Directory traversal vulnerability in a support component in …
• CVE-2009-2970Stack-based buffer overflow in the GetUiDllVersion function …
• CVE-2009-2972in.lpd in the print service in Sun Solaris 8 and 9 allows re…