| Package | Affected versions | Patched versions |
|---|---|---|
| phpmailer/phpmailer | ≥ 5.0.0, < 5.2.14 | 5.2.14 |
| phpmailer | ≤ 5.2.13 |
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.
Fixed in 5.2.14 in this commit.
Manually strip line breaks from email addresses before passing them to PHPMailer.
https://nvd.nist.gov/vuln/detail/CVE-2015-8476
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free