FLAT-7YGY4 – Vulnerability | Fluid Attacks Database

Database

Description

multiple issues

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	phpmailer/phpmailer	>=5.0.0 <5.2.18	5.2.18
alpine v3.2	php-phpmailer	=5.2.0-r0 \|\| >=0 <5.2.4-r0	5.2.4-r0
alpine v3.5	php5-phpmailer	=5.2.0-r0 \|\| =5.2.4-r0 \|\| >=0 <5.2.4-r1	5.2.4-r1
debian 12	libphp-phpmailer	>=0 <5.2.14+dfsg-2.1	5.2.14+dfsg-2.1
alpine v3.3	php-phpmailer	=5.2.0-r0 \|\| >=0 <5.2.4-r0	5.2.4-r0
debian 13	libphp-phpmailer	>=0 <5.2.14+dfsg-2.1	5.2.14+dfsg-2.1
alpine v3.4	php5-phpmailer	=5.2.0-r0 \|\| >=0 <5.2.0-r1	5.2.0-r1
debian 11	libphp-phpmailer	>=0 <5.2.14+dfsg-2.1	5.2.14+dfsg-2.1
alpm rolling_release	wordpress	>=4.7-1 <4.7.1-1	4.7.1-1
debian 14	libphp-phpmailer	>=0 <5.2.14+dfsg-2.1	5.2.14+dfsg-2.1

Aliases

1. CVE-2016-100332. NVD-2016-100333. OSV-2016-100334. OSV-ALPINE-2016-100335. OSV-DEBIAN-2016-100336. GHSA-5f37-gxvh-23v67. GCVE-2016-100338. SECURITY-CVE-2016-100339. SECURITY-TRACKER-CVE-2016-10033

References

1. https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v62. https://www.exploit-db.com/exploits/422213. https://www.exploit-db.com/exploits/420244. https://www.exploit-db.com/exploits/419965. https://www.exploit-db.com/exploits/419626. https://www.exploit-db.com/exploits/409867. https://www.exploit-db.com/exploits/409748. https://www.exploit-db.com/exploits/409709. https://www.exploit-db.com/exploits/4096910. https://www.exploit-db.com/exploits/4096811. https://www.drupal.org/psa-2016-00412. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1003313. https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html14. https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities15. https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.1816. https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml17. https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html18. http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html19. http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html20. http://seclists.org/fulldisclosure/2016/Dec/7821. http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection22. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml23. https://github.com/opsxcq/exploit-CVE-2016-1003324. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb25. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.