UBUNTU-CVE-2016-10074: Critical severity ubuntu/libphp-swiftmailer vulnerability
The mail transport (aka SwiftTransportMailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libphp-swiftmailerto a version that resolves this vulnerability.Fixed in 5.4.2-1.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Swift Mailer versions before 5.4.5 are affected when they use the Swift_Transport_MailTransport mail transport. The listed Ubuntu software package is ubuntu/libphp-swiftmailer.
What must an attacker be able to control?
An attacker needs to supply a crafted e-mail address containing a backslash followed by a double quote in the From, ReturnPath, or Sender header. The vulnerability is rated network-accessible and requires neither privileges nor user interaction.