SquirrelMail

From Wikipedia, the free encyclopedia

Template:Short description Template:DMCA

Page Module:Infobox/styles.css has no content.

SquirrelMail
[[Programmer|Original authorTemplate:Pluralize from text]]Nathan and Luke Ehresman[1]
[[Programmer|DeveloperTemplate:Pluralize from text]]The SquirrelMail Project Team
Initial release1999; 27 years ago (1999)
Template:Infobox software/simple
Written inPHP, C[1]
EnginePage Template:Plainlist/styles.css has no content.
Template:EditAtWikidata
PlatformWeb platform
Available in56 languages[2]
Page Template:Hidden begin/styles.css has no content.
List of languages
Arabic, Bahasa Indonesia, Bahasa Melayu, Bangladeshi Bengali, Basque, Brazilian Portuguese, British, Bulgarian, Catalan, Chinese Simplified, Chinese Traditional, Croatian, Czech, Danish, Dutch, Estonian, Faroese, Finnish, French, Frisian, Georgian, German, Greek, Hebrew, Hungarian, Icelandic, Indian Bengali, Italian, Japanese, Khmer, Korean, Latvian, Lithuanian, Macedonian, Norwegian Bokmål, Norwegian Nynorsk, Persian, Polish, Portuguese, Romanian, Russian, Russian Ukrainian, Serbian, Sinhala, Slovak, Slovenian, Spanish, Swedish, Tagalog, Tamil, Thai, Turkish, Uighur, Ukrainian, Vietnamese, Welsh
TypeWebmail
LicenseGPL-2.0-or-later
WebsiteScript error: No such module "WikidataIB".
RepositoryPage Template:Plainlist/styles.css has no content.

Script error: No such module "Check for conflicting parameters".

SquirrelMail is an open-source webmail application written in PHP. It provides a web-based interface for accessing email via the IMAP protocol and sends messages through SMTP. The project also includes a separate IMAP proxy server written in C. Both components are released under the GNU General Public License version 2 or later.[1]

The last numbered stable release was version 1.4.22 in July 2011.[3] Since then, the project has continued through SVN snapshots; the current stable branch (1.4.23-svn) is tested with PHP up to version 8.1. SquirrelMail was once widely deployed and included in the repositories of major Linux distributions,[4][5] but its use has declined since the mid-2010s as hosting providers replaced it with Roundcube and other alternatives.

History

Nathan and Luke Ehresman started SquirrelMail in 1999.[1] The application runs on a LAMP stack or any other platform supporting PHP, and requires access to an IMAP server for mail storage and an SMTP server for sending.[6]

The webmail interface renders HTML 4.0, which made it compatible with a wide range of browsers at the time of its initial release.[6] A plugin architecture allows additional features to be added to the core application, and over 200 plugins were available from the project website.[7]

Apple shipped SquirrelMail as the default webmail application in Mac OS X Server.[8] The software was included in repositories for Fedora,[9] openSUSE,[10] Debian,[11] CentOS,[12] Ubuntu, Gentoo,[13] and FreeBSD.[14]

IMAP proxy

The IMAP proxy component was created in 2002 by Dave McMurtrie at the University of Pittsburgh, where it was called "up-imapproxy".[15] The SquirrelMail team adopted it in 2010. Written in C, the proxy maintains persistent connections to the IMAP server, avoiding the overhead of a new IMAP login on each HTTP request. It compiles on most Unix variants but does not run natively on Microsoft Windows outside of Cygwin or a similar environment.

Decline

The last numbered release, version 1.4.22, was published on 12 July 2011.[3] Subsequent maintenance has been distributed only as SVN snapshots. cPanel removed SquirrelMail in version 78 (2018), replacing it with Roundcube as its default webmail client. Other hosting control panels followed: DirectAdmin disabled SquirrelMail by default for new installations.[16] The SourceForge project page still receives several hundred downloads per week as of 2026.[17]

Security

2007 supply-chain compromise

In December 2007, an attacker gained access to the SquirrelMail file release system on SourceForge through a compromised developer account and replaced the version 1.4.11 and 1.4.12 tarballs with modified copies containing a backdoor allowing remote code execution.[18] Users noticed that the published MD5 checksums did not match the downloaded files. The project initially downplayed the issue, but security researcher Uwe Schindler demonstrated that the modifications opened a full remote code execution path.[18][19] The project released version 1.4.13 as a clean replacement. The source code repository itself was not affected. The incident was assigned Template:CVE.[20]

Other vulnerabilities

In 2017, a remote code execution vulnerability (Template:CVE) was disclosed in SquirrelMail's handling of the Sendmail command-line interface. An authenticated user could inject commands through the Return-Path header by using a tab character, allowing arbitrary command execution on the server.[21] In 2025, a cross-site scripting vulnerability (Template:CVE) was found in the MIME handling code, affecting versions through 1.4.23-svn.[22]

Plugins

The core application is a complete webmail system, but extra features are available through plugins. Over 200 third-party plugins were available for download from the SquirrelMail website, and the project ships with several built-in plugins.[7]

Internationalization

SquirrelMail has been translated into over 50 languages including Arabic, Chinese, French, German, and Spanish.[2]

Deployments

In March 2009, the Prime Minister's Office of India replaced Outlook Express with SquirrelMail after a virus caused a three-month email outage.[23][24] During the outage, messages from citizens went unanswered, and the PMO admitted in a hearing of the Central Information Commission that many emails had not been received.[24]

In 2004, HEC Montréal deployed SquirrelMail as part of its webmail infrastructure, supporting thousands of users.[25]

See also

Lua error in mw.title.lua at line 404: bad argument #2 to 'title.new' (unrecognized namespace name 'Portal').

Page Module:Side box/styles.css has no content.Page Template:Sister project/styles.css has no content.

Page Template:Plainlist/styles.css has no content.
Script error: No such module "Sister project logo".
Wikimedia Commons has media related to SquirrelMail.Template:Preview warning

References

Page Template:Reflist/styles.css has no content.

  1. ^ a b c d Page Module:Citation/CS1/styles.css has no content."SquirrelMail history". Squirrelmail.org. Retrieved 11 August 2009.
  2. ^ a b Page Module:Citation/CS1/styles.css has no content."SquirrelMail translation statistics". L10n-stats.squirrelmail.org. 16 June 2009. Retrieved 11 August 2009.
  3. ^ a b Page Module:Citation/CS1/styles.css has no content."SquirrelMail 1.4.22 Released". SourceForge.net. 12 July 2011. Retrieved 10 March 2026.
  4. ^ Page Module:Citation/CS1/styles.css has no content."Debian – Package Search Results – squirrelmail". debian.org. Retrieved 6 March 2010.
  5. ^ Page Module:Citation/CS1/styles.css has no content."Ubuntu – Package Search Results – squirrelmail". ubuntu.com. Retrieved 6 March 2010.
  6. ^ a b Page Module:Citation/CS1/styles.css has no content."SquirrelMail, a Web-Based Mail Server – O'Reilly Media". onlamp.com. Archived from the original on 25 July 2010. Retrieved 29 July 2010.
  7. ^ a b Page Module:Citation/CS1/styles.css has no content.Wallen, Jack (7 August 2007). "SolutionBase: Taking SquirrelMail to new levels". Articles.techrepublic.com.com. Archived from the original on 31 December 2009. Retrieved 31 October 2010.
  8. ^ Page Module:Citation/CS1/styles.css has no content."Peachpit: Mac OS X Server Mail Service Boot Camp: Advanced Mailing List Features and Web Mail". 13 October 2006. Retrieved 30 August 2010.
  9. ^ Page Module:Citation/CS1/styles.css has no content."Fedora Package Database – squirrelmail". fedoraproject.org. Archived from the original on 20 December 2012. Retrieved 6 March 2010.
  10. ^ Page Module:Citation/CS1/styles.css has no content."Novell: openSUSE 10.3: squirrelmail". novell.com. Archived from the original on 11 April 2011. Retrieved 6 March 2010.
  11. ^ Page Module:Citation/CS1/styles.css has no content."Debian – Package Search Results – squirrelmail". debian.org. Retrieved 6 March 2010.
  12. ^ Page Module:Citation/CS1/styles.css has no content."CentOS Package List". centos.org. Archived from the original on 9 March 2010. Retrieved 6 March 2010.
  13. ^ Page Module:Citation/CS1/styles.css has no content."Gentoo Packages /package/mail-client/squirrelmail". gentoo.org. Archived from the original on 26 September 2010. Retrieved 6 March 2010.
  14. ^ Page Module:Citation/CS1/styles.css has no content."FreeBSD Ports Search – squirrelmail". freebsd.org. Retrieved 6 March 2010.
  15. ^ Page Module:Citation/CS1/styles.css has no content."IMAP Proxy home page". Retrieved 15 November 2010.
  16. ^ Page Module:Citation/CS1/styles.css has no content."SquirrelMail released PHP8 support". DirectAdmin Forums. Retrieved 10 March 2026.
  17. ^ Page Module:Citation/CS1/styles.css has no content."Project Statistics for SquirrelMail". sourceforge.net. Retrieved 25 July 2018.
  18. ^ a b Page Module:Citation/CS1/styles.css has no content."The backdooring of SquirrelMail". LWN.net. 19 December 2007. Retrieved 10 March 2026.
  19. ^ Page Module:Citation/CS1/styles.css has no content."Latest SquirrelMail download compromised". Help Net Security. 14 December 2007. Retrieved 10 March 2026.
  20. ^ Page Module:Citation/CS1/styles.css has no content."Bug 425291 – CVE-2007-6348 squirrelmail: Compromise of squirrelmail.org/sourceforge". Red Hat Bugzilla. Retrieved 10 March 2026.
  21. ^ Page Module:Citation/CS1/styles.css has no content."SquirrelMail – Remote Code Execution – CVE-2017-7692". legalhackers.com. Retrieved 10 March 2026.
  22. ^ Page Module:Citation/CS1/styles.css has no content."CVE-2025-30090". CVE Feed. Retrieved 10 March 2026.
  23. ^ Page Module:Citation/CS1/styles.css has no content."Microsoft dumped after India PM's emails go AWOL". The Register. 17 March 2009. Retrieved 6 March 2010.
  24. ^ a b Page Module:Citation/CS1/styles.css has no content."PMO's email system infected for three months". The Times of India. 15 March 2009. Archived from the original on 11 August 2011. Retrieved 6 March 2010.
  25. ^ Page Module:Citation/CS1/styles.css has no content."HEC Montréal: Deployment of a Large-Scale Mail Installation". linuxjournal.com. 1 May 2004. Retrieved 25 July 2010.
  • Lua error in Module:Official_website at line 94: attempt to index field 'wikibase' (a nil value).

Lua error in package.lua at line 80: module 'Module:Authority control/config' not found. Lua error in package.lua at line 80: module 'Module:Navbox/configuration' not found.

Retrieved from "http://cosmopedia.co/index.php?title=SquirrelMail&oldid=647588"