Ubuntu update for libphp-phpmailer
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 7 |
| CVE-ID | CVE-2016-10033 CVE-2016-10045 CVE-2017-11503 CVE-2017-5223 CVE-2018-19296 CVE-2020-13625 CVE-2021-3603 |
| CWE-ID | CWE-94 CWE-79 CWE-200 CWE-20 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #4 is available. |
| Vulnerable software |
Ubuntu Operating systems & Components / Operating system libphp-phpmailer (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 7 vulnerabilities.
1) Remote code injection
EUVDB-ID: #VU3118
Risk: High
CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2016-10033
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient sanitization of user-supplied input passed via specially crafted “From” address to mailSend() function. A remote attacker can use backslashed double quote character (e.g. \") to pass additional commands to original mail command and execute them with privileges of the current web server user.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3- cpe:2.3:o:canonical:ubuntu:16.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:18.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:libphp-phpmailer_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
2) Remote code injection
EUVDB-ID: #VU3119
Risk: High
CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2016-10045
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in PHPMailer due to insufficient sanitization of user-supplied input, when Sender property is not set. A remote attacker can use backslashed double quote character (e.g. \”) to pass additional commands to original mail command and execute them with privileges of the current web server user.
Successful exploitation of the vulnerability may result in system compromise.
Note: this vulnerability exists due to incorrect fix for vulnerability SB2016122601 (CVE-2016-10033)
Update the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3 External linkshttps://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
3) Cross-site scripting
EUVDB-ID: #VU7653
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-11503
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote unauthenticated attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient validation of user-supplied data passed via specially crafted parameter to 'code_generator.phps' example script. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim’s browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3 External linkshttps://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Information disclosure
EUVDB-ID: #VU4756
Risk: Medium
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2017-5223
CWE-ID:
CWE-200 - Information exposure
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to obtain access to potentially sensitive information.
The vulnerability exists in PHPMailer before 5.2.22 when handling HTML documents using msgHTML() method. A remote attacker can create a specially crafted message, containing relative links to images withing message and attach arbitrary local file to e-mail message.
Successful exploitation of this vulnerability may allow an attacker to send out arbitrary system files as email attachments.
Update the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3 External linkshttps://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
5) Object injection attack
EUVDB-ID: #VU16334
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2018-19296
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to object injection attack. A remote unauthenticated attacker can send a specially crafted request, conduct object injection attack and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3 External linkshttps://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Input validation error
EUVDB-ID: #VU29531
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-13625
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions
The vulnerability exists due to insufficient validation of user-supplied file attachments with a double quote character. A remote attacker can pass specially crafted filename to the application and bypass implemented security restrictions.
Update the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3 External linkshttps://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Code Injection
EUVDB-ID: #VU54171
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-3603
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to improper input validation. If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package libphp-phpmailer to the latest version.
Vulnerable software versionsUbuntu: 16.04 - 22.04
libphp-phpmailer (Ubuntu package): before Ubuntu Pro
CPE2.3 External linkshttps://ubuntu.com/security/notices/USN-5956-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
