CVE-2006-0377: CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMA...

Security readout for executives and security teams

This is an old SquirrelMail issue where crafted mailbox input could alter IMAP commands sent by the webmail application. The business risk matters mainly if legacy SquirrelMail 1.4.0 through 1.4.5 is still deployed. No active exploitation evidence is provided in the bundle. Exposure is likely limited to environments still running SquirrelMail 1.4.0 through 1.4.5. Internet-facing or shared internal webmail deployments are the main concern. Modern systems are unlikely to be affected unless legacy packages remain in service. Treat as a legacy exposure cleanup item unless affected SquirrelMail is still reachable. If found on an internet-facing system, prioritize remediation because the flaw crosses from web input into mail-server commands. Mitigation focus: Inventory any SquirrelMail deployments and confirm exact version numbers.; Check SquirrelMail and operating system vendor advisories for fixed packages.; Upgrade, replace, or retire SquirrelMail 1.4.0 through 1.4.5 where found..

Prepared

Jun 29, 2026, 14:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.