Vulnerability Details CVE-2015-8476
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 77.0%
CVSS Severity
CVSS v2 Score 5.0
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
- http://www.debian.org/security/2015/dsa-3416
- http://www.openwall.com/lists/oss-security/2015/12/04/5
- http://www.openwall.com/lists/oss-security/2015/12/05/1
- http://www.securityfocus.com/bid/78619
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
- http://www.debian.org/security/2015/dsa-3416
- http://www.openwall.com/lists/oss-security/2015/12/04/5
- http://www.openwall.com/lists/oss-security/2015/12/05/1
- http://www.securityfocus.com/bid/78619
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14
Products affected by CVE-2015-8476
-
cpe:2.3:a:phpmailer_project:phpmailer:2.0.3
-
cpe:2.3:a:phpmailer_project:phpmailer:2.2.1
-
cpe:2.3:a:phpmailer_project:phpmailer:2.3.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.0.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.0.2
-
cpe:2.3:a:phpmailer_project:phpmailer:5.1.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.1
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.10
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.11
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.12
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.13
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.2
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.4
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.5
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.6
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.7
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.8
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.9
-
cpe:2.3:o:debian:debian_linux:6.0
-
cpe:2.3:o:debian:debian_linux:7.0
-
cpe:2.3:o:debian:debian_linux:8.0