CVE-2005-3883: CRLF Injection
Published Nov 29, 2005
·Updated
CRLF injection vulnerability in the mbsendmail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument.
Affected Software
36 affected components
PHP PHP=4.3.9
PHP PHP=4.2.0
PHP PHP=4.1.0
PHP PHP=4.3.4
PHP PHP=4.3.0
PHP PHP=5.0-rc1
PHP PHP=5.0.5
PHP PHP=4.3.6
PHP PHP=5.0.1
PHP PHP=4.0.7-rc2
PHP PHP=4.3.7
PHP PHP=5.0.4
PHP PHP=4.0.7-rc1
PHP PHP=4.2.2
PHP PHP=4.3.2
PHP PHP=4.3.11
PHP PHP=4.0.7
PHP PHP=4.3.3
PHP PHP=5.0-rc3
PHP PHP=4.1.1
PHP PHP=5.0.3
PHP PHP=4.2.3
PHP PHP=4.0.6
PHP PHP=5.0-rc2
PHP PHP=4.1.2
PHP PHP=4.0.7-rc3
PHP PHP=4.3.1
PHP PHP=4.4.0
PHP PHP=4.3.10
PHP PHP=4.2.1
PHP PHP=5.0.2
PHP PHP=4.2
PHP PHP=4.4.1
PHP PHP=5.0.0
PHP PHP=4.3.8
PHP PHP=4.3.5
Remediation
Patch Available
Patch Available
Patch Available
Event History
Nov 29, 2005
CVE Published
11:03 AM
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-3883?
CVE-2005-3883 is considered a moderate severity vulnerability due to its potential for email header injection.
2
How do I fix CVE-2005-3883?
To fix CVE-2005-3883, upgrade PHP to version 5.1.0 or later where the vulnerability has been addressed.
3
What versions of PHP are affected by CVE-2005-3883?
CVE-2005-3883 affects PHP versions 4.0.6 through 5.0.5.
4
What kind of attacks can exploit CVE-2005-3883?
CVE-2005-3883 can be exploited to perform arbitrary email header injection, allowing attackers to spoof emails.
5
Is CVE-2005-3883 a remote code execution vulnerability?
No, CVE-2005-3883 is not a remote code execution vulnerability, but it does allow for email header manipulation.