Vulnerability Description
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 6.0 |
| Phpmailer Project | Phpmailer | <= 5.2.13 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.h
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.h
- http://www.debian.org/security/2015/dsa-3416
- http://www.openwall.com/lists/oss-security/2015/12/04/5
- http://www.openwall.com/lists/oss-security/2015/12/05/1
- http://www.securityfocus.com/bid/78619
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae47
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.h
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.h
- http://www.debian.org/security/2015/dsa-3416
- http://www.openwall.com/lists/oss-security/2015/12/04/5
- http://www.openwall.com/lists/oss-security/2015/12/05/1
- http://www.securityfocus.com/bid/78619
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae47
FAQ
What is CVE-2015-8476?
CVE-2015-8476 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class...
How severe is CVE-2015-8476?
CVE-2015-8476 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-8476?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Phpmailer Project Phpmailer.