Advisories » MGASA-2015-0484

Updated php-phpmailer packages fix CVE-2015-8476

Publication date: 24 Dec 2015
Modification date: 24 Dec 2015
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-8476

Description

Updated php-phpmailer package fixes security vulnerability:

Takeshi Terada discovered that PHPMailer accepted addresses containing line
breaks. This is valid in RFC5322, but allowing such addresses resulted in
invalid RFC5321 SMTP commands, permitting a kind of message injection attack
(CVE-2015-8476).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=17319
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
• http://lwn.net/Alerts/667302/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8476

SRPMS

5/core

• php-phpmailer-5.2.14-1.mga5