libphp-phpmailer: CVE-2018-19296

Debian Bug report logs - #913912
libphp-phpmailer: CVE-2018-19296

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libphp-phpmailer: CVE-2018-19296

Date: Fri, 16 Nov 2018 21:26:49 +0100

Source: libphp-phpmailer
Version: 5.2.14+dfsg-2.3
Severity: grave
Tags: patch security upstream

Hi,

The following vulnerability was published for libphp-phpmailer.

CVE-2018-19296[0]:
| PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object
| injection attack.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-19296
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19296
[1] https://github.com/PHPMailer/PHPMailer/commit/f1231a9771505f4f34da060390d82eadb8448271

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 913912@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 913912@bugs.debian.org

Subject: Re: Bug#913912: libphp-phpmailer: CVE-2018-19296

Date: Sat, 1 Dec 2018 16:42:17 +0100

[Message part 1 (text/plain, inline)]

Hi

Attached is the proposed debdiff for this issue backported to the
repsective base version 5.2.14.

Regards,
Salvatore

[libphp-phpmailer_5.2.14+dfsg-2.4.debdiff (text/plain, attachment)]

Message #15 received at 913912-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 913912-close@bugs.debian.org

Subject: Bug#913912: fixed in libphp-phpmailer 5.2.14+dfsg-2.4

Date: Mon, 03 Dec 2018 16:38:24 +0000

Source: libphp-phpmailer
Source-Version: 5.2.14+dfsg-2.4

We believe that the bug you reported is fixed in the latest version of
libphp-phpmailer, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 913912@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libphp-phpmailer package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 01 Dec 2018 15:09:47 +0100
Source: libphp-phpmailer
Binary: libphp-phpmailer
Architecture: source
Version: 5.2.14+dfsg-2.4
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
 libphp-phpmailer - full featured email transfer class for PHP
Closes: 913912
Changes:
 libphp-phpmailer (5.2.14+dfsg-2.4) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * object injection vulnerability (CVE-2018-19296) (Closes: #913912)
Checksums-Sha1:
 3b31513c9bf37763bbc4635c3915d990a51317d6 2243 libphp-phpmailer_5.2.14+dfsg-2.4.dsc
 28beff68c75a1a7a6c1cb10e348a964327e7c9e5 10960 libphp-phpmailer_5.2.14+dfsg-2.4.debian.tar.xz
 4a0f40f28d6a2c26a40dfacbaf0a2aaffa3e1e45 6158 libphp-phpmailer_5.2.14+dfsg-2.4_source.buildinfo
Checksums-Sha256:
 19eb33fe34aeb1f0d4ad62b8dbef31e145764432b0b9a1301615e351dd138278 2243 libphp-phpmailer_5.2.14+dfsg-2.4.dsc
 a7089b46160f273a0a769be1dfab95ee5292201d4dba82ac161b2c449f25a516 10960 libphp-phpmailer_5.2.14+dfsg-2.4.debian.tar.xz
 ea083005319d244ed78e1d3acf3bcaa36c91225c145ea9a24aac7f1d83905df0 6158 libphp-phpmailer_5.2.14+dfsg-2.4_source.buildinfo
Files:
 56695e2d32929d3498e955fa9802443b 2243 php optional libphp-phpmailer_5.2.14+dfsg-2.4.dsc
 f664cdaa28e6f46eb591ce336b4c855c 10960 php optional libphp-phpmailer_5.2.14+dfsg-2.4.debian.tar.xz
 6e9e87693e3ff63a06d617224b979c1f 6158 php optional libphp-phpmailer_5.2.14+dfsg-2.4_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlwFV0hfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89Ee8IP/19C+oYZyyBkO2BLYGlCb1myyjoJ8NX4
TSHX2s1cWu8QZGSVegJHE5mkcJXG7cbcT5lFeFfLII/yAvTgTU3eb+gKxeUt/xIG
k98iSvtMelLkjTGctgTPEfhWVNHCIj80eO8Tcm3uYAyBWP3A/QV20Q+Rf6MOzF0m
Lm32fqrtkMjpQPQ+5ERiC0pwfo9MfW9iGCpKjxGCKaxRhMMB5JFb2S9Pbn5xg8qb
G+XfU+m9Nsvg9VhAdezJmJec5vs6rIXl1B4U6Z1Rkhk+9wxNzwCd8aNv3QAB/sn3
GIh/VgO4wCwc2cmThfVDUbxocLWhtha+Q09xJGQRfkA3HsFuSXOw4tJdEAKLG1qc
eMVpmwRxESdJ3FBeVcgQmOHu6dSiHtXYnOkZkiUNbsnL6Y9dPWwXOwcjRiaHZ/sp
HCoZk9rGaN64fZ52luFFqhmocX19UAdaJXEGEM7T1HSyT0mWRr9rPNSZFOwRKi0O
S8wRwRwa3pY3uRDlgQvTQS/rbXD8eaSa/Ea3r47CPmmMayTYe0c67vJLVgZ8iWEs
TpwQ6iKzozn7ZHN6FcWG9R0rGdEvmFlRJsKubuKEWJiabcjBPeOXvcqQx/wauLVb
s4q5LuciXEjYUL8fJHx78ZCi9c88raMLV1uDTdrtM57kv9PPeHf51/YcZC5osaY+
E52nKb1ZLQPG
=e1mA
-----END PGP SIGNATURE-----

Message #20 received at 913912-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 913912-close@bugs.debian.org

Subject: Bug#913912: fixed in libphp-phpmailer 5.2.14+dfsg-2.3+deb9u1

Date: Fri, 07 Dec 2018 20:45:16 +0000

Source: libphp-phpmailer
Source-Version: 5.2.14+dfsg-2.3+deb9u1

We believe that the bug you reported is fixed in the latest version of
libphp-phpmailer, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 913912@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libphp-phpmailer package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 01 Dec 2018 15:09:47 +0100
Source: libphp-phpmailer
Binary: libphp-phpmailer
Architecture: source
Version: 5.2.14+dfsg-2.3+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
 libphp-phpmailer - full featured email transfer class for PHP
Closes: 913912
Changes:
 libphp-phpmailer (5.2.14+dfsg-2.3+deb9u1) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * object injection vulnerability (CVE-2018-19296) (Closes: #913912)
Checksums-Sha1:
 47838164fd361427768d694f19402a3f7cc4310b 2271 libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1.dsc
 e50440d06aa1f4313f6fa389610a209f04e6e65b 181823 libphp-phpmailer_5.2.14+dfsg.orig.tar.gz
 a85390fe0362b603c98f90bdc9468e50f3acecf2 10984 libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1.debian.tar.xz
 9e8b446277df6835d7b91ee693b9bdd7773f0088 6185 libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1_source.buildinfo
Checksums-Sha256:
 b79e23f2f8a9593740752050dea5e3528009a26c6de8c4d811b964bddb3daee6 2271 libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1.dsc
 781867a508160136ab5b8792c893e40775c583708ff2b90904f57fb6b0bd6370 181823 libphp-phpmailer_5.2.14+dfsg.orig.tar.gz
 fb865b24e5c4d4f78c51a7c30257fede66d7fbc558646f9b3085256a13ea806b 10984 libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1.debian.tar.xz
 a8804929f2457a3ecfbafccc74626a49b2e2e3665b55bd12edcf09eeb563f049 6185 libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1_source.buildinfo
Files:
 c99a5cdca84e063b3525ab62808b6bf8 2271 php optional libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1.dsc
 f80d964ba6574a8aeca45e078aec0f39 181823 php optional libphp-phpmailer_5.2.14+dfsg.orig.tar.gz
 2c393188020f4a549432988f08cf9798 10984 php optional libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1.debian.tar.xz
 a37570f8274cf6233ed8b46fa73803c0 6185 php optional libphp-phpmailer_5.2.14+dfsg-2.3+deb9u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlwJhhtfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EczcQAJUfIhfaAnO4KNAd2WF42hQOSPXqKePd
7vpG2MFtCXGcY3Whfcd0hAcF4rqmqYkjEQwd0y4aN3UcT9VsS0FYE0gZlbdv80q9
R7ZxWp6/Y7Y2ISepPqkun3fVi9HkfvqypnQnz1J/v2DeAQw2n2DeMfJQogG61Qaj
TMlItK04Kq0VZC9Ex7b22emS5dq60F1zycET7f/UsrDCz4NPPXEyTV3GtrO3Hggh
QtnoYQOiinufcnOjv0GHs4QN285IbVxOWuGFr51GG2b82fY9Erb8W1ojH/0a5g+z
fbErEC7JorKlsutD4Tw/co3yOzSXD8XgwQC7+sR/9gLAT907W/WYLqbD4+qxt9iy
TydMoJU3heOiKKAw43M2CexE3JlDTE7OD06cudkPwjaMsGx7bcmpWkR3UHjJ8Orn
rnwjNLsZDdEeBti4TDAmmEuePLzY090JXxaYDOXr0uExuaNE/grVCB8bIWS+nZFx
Q8yfduY/LV9dwVvjnviA6EoZ0YoqBliAplsGu/QjDI4CHJL7Cr+IQzGPDEGmXS/d
LoNNUmcoSCjui4vnQVpvqMftbPwgy10XE9Ro8mJrc8P/gy7/vSBJS6UkTqBjiOE0
kFuRdBqVH1xVGJCtNPCxGQKctP+fR14GDnjos2Es3ihk54tE0s05r42i3gGO6T7T
Wlw1AkvGTrEY
=8Upl
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.