Fluid Attacks Database

Description

PHPMailer susceptible to arbitrary code execution html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	phpmailer/phpmailer	>=0 <5.2.10	5.2.10
debian 11	roundcube	>=0 <0.1.1-9	0.1.1-9
debian 12	roundcube	>=0 <0.1.1-9	0.1.1-9
debian 13	roundcube	>=0 <0.1.1-9	0.1.1-9
debian 14	roundcube	>=0 <0.1.1-9	0.1.1-9

Aliases

1. CVE-2008-56192. NVD-2008-56193. OSV-2008-56194. OSV-DEBIAN-2008-56195. GCVE-2008-56196. SECURITY-TRACKER-CVE-2008-5619

References

1. https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a2. https://github.com/PHPMailer/PHPMailer3. https://www.exploit-db.com/exploits/75494. https://www.exploit-db.com/exploits/75535. https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html6. https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html7. http://mahara.org/interaction/forum/topic.php?id=5338. http://osvdb.org/538939. http://sourceforge.net/forum/forum.php?forum_id=89854210. http://trac.roundcube.net/changeset/214811. http://trac.roundcube.net/ticket/148561812. http://www.openwall.com/lists/oss-security/2008/12/12/1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.