CVE-2015-8476: CRLF Injection
Published Nov 1, 2015
·Updated
Multiple CRLF injection vulnerabilities
Affected Software
5 affected componentsFixes available
composer/phpmailer/phpmailer>=5.0.0, <5.2.14
5.2.14
Debian Debian Linux=6.0
Debian Debian Linux=7.0
Debian Debian Linux=8.0
PHPMailer project PHPMailer<=5.2.13
Event History
Nov 1, 2015
Advisory Published
10:15 AM
Dec 16, 2015
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8476?
CVE-2015-8476 is considered to have moderate severity due to the potential for CRLF injection which can lead to arbitrary SMTP command execution.
2
How do I fix CVE-2015-8476?
To fix CVE-2015-8476, upgrade PHPMailer to version 5.2.14 or later, as it includes patches for this vulnerability.
3
What components are affected by CVE-2015-8476?
CVE-2015-8476 affects PHPMailer versions prior to 5.2.14 and specific Debian Linux versions 6.0, 7.0, and 8.0.
4
How does CVE-2015-8476 impact email security?
CVE-2015-8476 can compromise email security by allowing attackers to inject arbitrary commands, potentially leading to unauthorized email manipulation.
5
Are there any known exploits for CVE-2015-8476?
There are no widely reported exploits for CVE-2015-8476, but its existence poses a significant risk if left unpatched.