| Name | CVE-2016-10033 |
| Description | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-770-1, DSA-3750-1 |
| Debian Bugs | 849365 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libphp-phpmailer (PTS) | bullseye | 6.2.0-2 | fixed |
| bookworm | 6.6.3-1 | fixed | |
| forky, sid, trixie | 6.9.3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libphp-phpmailer | source | wheezy | 5.1-1.2 | DLA-770-1 | ||
| libphp-phpmailer | source | jessie | 5.2.9+dfsg-2+deb8u2 | DSA-3750-1 | ||
| libphp-phpmailer | source | (unstable) | 5.2.14+dfsg-2.1 | 849365 |
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
Fixed by: https://github.com/PHPMailer/PHPMailer/commit/4835657cd639fbd09afd33307cef164edf807cdc#diff-ace81e501931d8763b49f2410cf3094dR1449
Fix potentially incomplete, cf https://www.openwall.com/lists/oss-security/2016/12/28/1
When updating libphp-phpmailer for CVE-2016-10033 make sure to apply the
complete patch to not make libphp-phpmailer affected by CVE-2016-10045.
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
Needs followup: https://github.com/PHPMailer/PHPMailer/commit/9743ff5c7ee16e8d49187bd2e11149afb9485eae
Another followup: https://github.com/PHPMailer/PHPMailer/commit/833c35fe39715c3d01934508987e97af1fbc1ba0