CVE-2016-10074: Remote Code Execution when using the mail transport
Remote Code Execution when using the mail transport
Other sources
The mail transport (aka SwiftTransportMailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/swiftmailer/swiftmailerto a version that resolves this vulnerability.Fixed in 5.4.5 - Upgrade
Upgrade
ubuntu/libphp-swiftmailerto a version that resolves this vulnerability.Fixed in 5.4.2-1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10074?
CVE-2016-10074 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-10074?
To mitigate CVE-2016-10074, upgrade Swift Mailer to version 5.4.5 or later.
What software is affected by CVE-2016-10074?
CVE-2016-10074 affects Swift Mailer versions prior to 5.4.5, specifically versions 4.0.0 up to 5.4.4.
What type of attack does CVE-2016-10074 enable?
CVE-2016-10074 allows remote attackers to execute arbitrary code by injecting parameters into the mail transport command.
Is there a known exploit for CVE-2016-10074?
Yes, there are known exploits that leverage CVE-2016-10074 to execute malicious code.