| Name | CVE-2021-3603 |
| Description | PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 991666 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libphp-phpmailer (PTS) | buster | 6.0.6-0.1 | vulnerable |
| bullseye | 6.2.0-2 | vulnerable |
| bookworm | 6.6.3-1 | fixed |
| trixie, sid | 6.8.1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bullseye] - libphp-phpmailer <no-dsa> (Minor issue)
[buster] - libphp-phpmailer <no-dsa> (Minor issue)
[stretch] - libphp-phpmailer <postponed> (Minor issue, fix along with next DLA)
https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/
https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3 (v6.5.0)