GHSA-738m-f33v-qc2r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-738m-f33v-qc2r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/03/GHSA-738m-f33v-qc2r/GHSA-738m-f33v-qc2r.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-738m-f33v-qc2r
- Aliases
- Published
- 2020-03-05T22:09:19Z
- Modified
- 2024-12-02T05:46:53.337709Z
- Summary
- SMTP Injection in PHPMailer
- Details
-
Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.
Patches
Fixed in 5.2.14 in this commit.
Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.
References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476
For more information
If you have any questions or comments about this advisory: * Open a private issue in the PHPMailer project
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-20" ], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2020-03-05T21:57:18Z" }- References
-
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-738m-f33v-qc2r
- https://nvd.nist.gov/vuln/detail/CVE-2015-8476
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
- http://www.debian.org/security/2015/dsa-3416
- http://www.openwall.com/lists/oss-security/2015/12/04/5
- http://www.openwall.com/lists/oss-security/2015/12/05/1
- http://www.securityfocus.com/bid/78619
Affected packages
Packagist / phpmailer/phpmailer
Package
- Name
- phpmailer/phpmailer
- Purl
- pkg:composer/phpmailer/phpmailer