CVE-2009-1579: The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1....

Security readout for executives and security teams

This CVE affects older SquirrelMail and NaSMail webmail deployments. A malicious username could be mishandled by a mail alias lookup path and lead to operating system command execution. That makes legacy, internet-facing webmail the main business concern, especially where unsupported packages remain in production. Exposure is most likely on legacy SquirrelMail before 1.4.18 or NaSMail before 1.7, especially public webmail systems. Source data does not identify specific CPEs, so asset inventory and package provenance matter. Prioritize remediation if legacy SquirrelMail or NaSMail is still deployed, particularly on public-facing webmail. If those products are absent, this is mainly an inventory hygiene item. Mitigation focus: Upgrade SquirrelMail to 1.4.18 or later where applicable.; Upgrade NaSMail to 1.7 or later where applicable.; Check OS vendor advisories for backported fixed packages..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.