CVE-2021-3603

Name	CVE-2021-3603
Description	PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	991666

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libphp-phpmailer (PTS)	buster	6.0.6-0.1	vulnerable
	bullseye	6.2.0-2	vulnerable
	bookworm, sid	6.6.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libphp-phpmailer	source	(unstable)	6.6.3-1			991666

Notes

[bullseye] - libphp-phpmailer <no-dsa> (Minor issue)
[buster] - libphp-phpmailer <no-dsa> (Minor issue)
[stretch] - libphp-phpmailer <postponed> (Minor issue, fix along with next DLA)
https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/
https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3 (v6.5.0)