Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2015-8476

Published: 16/12/2015 Updated: 06/12/2016
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Subscribe to Debian

Vulnerability Summary

Multiple CRLF injection vulnerabilities in PHPMailer prior to 5.2.14 allow malicious users to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.

Vulnerable Product Search on Vulmon Subscribe to Product

debian debian linux 6.0

debian debian linux 7.0

debian debian linux 8.0

phpmailer project phpmailer

Vendor Advisories

Debian CVElist Bug Report Logs: libphp-phpmailer: CVE-2015-8476: Message Injection Vulnerability
Debian Bug report logs - #807265 libphp-phpmailer: CVE-2015-8476: Message Injection Vulnerability Package: libphp-phpmailer; Maintainer for libphp-phpmailer is Debian PHP PEAR Maintainers <pkg-php-pear@listsaliothdebianorg>; Source for libphp-phpmailer is src:libphp-phpmailer (PTS, buildd, popcon) Reported by: Salvatore B ...
Debian Security Advisories: DSA-3416-1 libphp-phpmailer -- security update
Takeshi Terada discovered a vulnerability in PHPMailer, a PHP library for email transfer, used by many CMSs The library accepted email addresses and SMTP commands containing line breaks, which can be abused by an attacker to inject messages For the oldstable distribution (wheezy), this problem has been fixed in version 51-11 For the stable dis ...

References

CWE-20http://www.openwall.com/lists/oss-security/2015/12/04/5https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14http://www.openwall.com/lists/oss-security/2015/12/05/1http://www.securityfocus.com/bid/78619http://www.debian.org/security/2015/dsa-3416http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.htmlhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807265https://nvd.nist.govhttps://www.debian.org/security/./dsa-3416
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581reflected XSSCVE-2024-26925CVE-2024-27956LFICVE-2024-3607CVE-2024-3107CVE-2024-3295SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook