CVE-2016-10045
Published: 30 December 2016
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Notes
| Author | Note |
|---|---|
| sbeattie | update from debian resulted in a regression fix (5.2.14+dfsg-2.2) |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libphp-phpmailer Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(5.2.14+dfsg-2.1)
|
| bionic |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| cosmic |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| disco |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| eoan |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| focal |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| hirsute |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| impish |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| jammy |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| trusty |
Does not exist
(trusty was needed)
|
|
| xenial |
Released
(5.2.14+dfsg-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| groovy |
Not vulnerable
(5.2.14+dfsg-2.1)
|
|
| precise |
Ignored
(end of life)
|
|
| upstream |
Released
(5.2.14+dfsg-2.1, 5.2.20)
|
|
|
Patches: upstream: https://github.com/PHPMailer/PHPMailer/commit/9743ff5c7ee16e8d49187bd2e11149afb9485eae upstream: https://github.com/PHPMailer/PHPMailer/commit/833c35fe39715c3d01934508987e97af1fbc1ba0 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10045
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- http://openwall.com/lists/oss-security/2016/12/28/1
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2016/Dec/81
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://www.exploit-db.com/exploits/40969/
- https://ubuntu.com/security/notices/USN-5956-1
- NVD
- Launchpad
- Debian