logo

Database

Lack of data validation In phpmailer/phpmailer

Description

SMTP Injection in PHPMailer

Impact

Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

Patches

Fixed in 5.2.14 in this commit.

Workarounds

Manually strip line breaks from email addresses before passing them to PHPMailer.

References

https://nvd.nist.gov/vuln/detail/CVE-2015-8476

For more information

If you have any questions or comments about this advisory:

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2015-84762. NVD-2015-84763. OSV-2015-84764. OSV-DEBIAN-2015-84765. GHSA-738m-f33v-qc2r6. GCVE-2015-84767. SECURITY-TRACKER-CVE-2015-8476

References

1. https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-738m-f33v-qc2r2. https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b03. https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml4. https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.145. http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html6. http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html7. http://www.debian.org/security/2015/dsa-34168. http://www.openwall.com/lists/oss-security/2015/12/04/59. http://www.openwall.com/lists/oss-security/2015/12/05/110. http://www.securityfocus.com/bid/78619

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.