CVE-2016-10074

Name	CVE-2016-10074
Description	The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-792-1, DSA-3769-1
Debian Bugs	849626

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libphp-swiftmailer (PTS)	buster	5.4.2-1.1	fixed
	bullseye	6.2.4-1	fixed
	bookworm	6.3.0-3	fixed
	sid, trixie	6.3.0-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libphp-swiftmailer	source	wheezy	4.1.5-1+deb7u1	DLA-792-1
libphp-swiftmailer	source	jessie	5.2.2-1+deb8u1	DSA-3769-1
libphp-swiftmailer	source	(unstable)	5.4.2-1.1		849626

Notes

https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html
https://github.com/swiftmailer/swiftmailer/issues/844
Fixed by https://github.com/swiftmailer/swiftmailer/commit/e6ccf40d856af9598b76eb313b215eed25ae9e86