GitHub Advisoryadvisory · Packagist
GHSA-738m-f33v-qc2r SMTP Injection in PHPMailer
LOW
Official page ↗
- Aliases
- CVE-2015-8476
- Ecosystem
- Packagist
- Packages
- phpmailer/phpmailer
- Severity
- Low
- Weaknesses
- CWE-20
- Reviewed
- 2020-03-05
Affected packages
• Packagist phpmailer/phpmailer: >= 5.0.0, < 5.2.14 → fixed in 5.2.14
Description
Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.
Patches
Fixed in 5.2.14 in this commit.
Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.
References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476
For more information
If you have any questions or comments about this advisory:
• Open a private issue in the PHPMailer project
Related
Alias · CVE (1)
- CVE-2015-8476 Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-738m-f33v-qc2r web
- https://nvd.nist.gov/vuln/detail/CVE-2015-8476 advisory
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml web
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14 web
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html web
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html web
- http://www.debian.org/security/2015/dsa-3416 web
- http://www.openwall.com/lists/oss-security/2015/12/04/5 web
- http://www.openwall.com/lists/oss-security/2015/12/05/1 web
- http://www.securityfocus.com/bid/78619 web