CVE-2016-10034
Published: 30 December 2016
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libphp-phpmailer Launchpad, Ubuntu, Debian |
precise |
Not vulnerable
(5.1-1+deb6u11build0.12.04.1)
|
| trusty |
Does not exist
(trusty was not-affected)
|
|
| upstream |
Released
(5.1)
|
|
| xenial |
Not vulnerable
|
|
| yakkety |
Not vulnerable
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |