LowGHSA-738m-f33v-qc2rCVE-2015-8476
SMTP Injection in PHPMailer
Published 5 Mar 2020 · Updated 2 Dec 2024
Affected package
phpmailer/phpmailerComposer
- Affected
- >=5.0.0 <5.2.14
- Fixed in
- 5.2.14
Update to the fixed version for your release line, for example:
composer require phpmailer/phpmailer:^5.2.14Details
Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.
Patches
Fixed in 5.2.14 in this commit.
Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.
References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476
For more information
If you have any questions or comments about this advisory:
- Open a private issue in the PHPMailer project
Is GHSA-738m-f33v-qc2r in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpmailer/phpmailer, and gives you the command that fixes it.
References
- Linkgithub.com/PHPMailer/PHPMailer/security/advisories/GHSA-738m-f33v-qc2r
- Advisorynvd.nist.gov/vuln/detail/CVE-2015-8476
- Linkgithub.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml
- Linkgithub.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
- Linklists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
- Linklists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
- Linkwww.debian.org/security/2015/dsa-3416
- Linkwww.openwall.com/lists/oss-security/2015/12/04/5
- Linkwww.openwall.com/lists/oss-security/2015/12/05/1
- Linkwww.securityfocus.com/bid/78619
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.