Most recent entries from all

bdu:2015-12236

cnvd-2015-08278

EUVD-2026-95774

fkie_cve-2015-8476

Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.

GHSA-738m-f33v-qc2r — SMTP Injection in PHPMailer

Affected: Packagist: phpmailer/phpmailer

### Impact Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

### Patches Fixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).

### Workarounds Manually strip line breaks from email addresses before passing them to PHPMailer.

### References https://nvd.nist.gov/vuln/detail/CVE-2015-8476

### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

gsd-2015-8476

UBUNTU-CVE-2015-8476

Affected: Ubuntu:14.04:LTS: libphp-phpmailer