CVE-2020-13625

Name	CVE-2020-13625
Description	PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-2244-1, DLA-2306-1
Debian Bugs	962827

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libphp-phpmailer (PTS)	buster	6.0.6-0.1	vulnerable
	bullseye	6.2.0-2	fixed
	bookworm, sid	6.6.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libphp-phpmailer	source	jessie	5.2.9+dfsg-2+deb8u6	DLA-2244-1
libphp-phpmailer	source	stretch	5.2.14+dfsg-2.3+deb9u2	DLA-2306-1
libphp-phpmailer	source	(unstable)	6.1.6-1		962827

Notes

[buster] - libphp-phpmailer <no-dsa> (Minor issue)
https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj
https://github.com/PHPMailer/PHPMailer/commit/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3