NVD Vulnerability Detail

CVE-2015-8476

Summary	Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Publication Date	Dec. 17, 2015, 6:59 a.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:38 a.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:phpmailer_project:phpmailer::::::::			5.2.13

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
5	http://www.debian.org/security/2015/dsa-3416
6	http://www.debian.org/security/2015/dsa-3416
7	http://www.openwall.com/lists/oss-security/2015/12/04/5
8	http://www.openwall.com/lists/oss-security/2015/12/04/5
9	http://www.openwall.com/lists/oss-security/2015/12/05/1
10	http://www.openwall.com/lists/oss-security/2015/12/05/1
11	http://www.securityfocus.com/bid/78619
12	http://www.securityfocus.com/bid/78619
13	https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
14	https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
15	https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14	Vendor Advisory
16	https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

PHPMailer における CRLF インジェクションの脆弱性

Title	PHPMailer における CRLF インジェクションの脆弱性
Summary	PHPMailer には、CRLF インジェクションの脆弱性が存在します。本脆弱性は、CVE-2012-0796 とは異なる脆弱性です。
Possible impacts	攻撃者により、以下の CRLF シーケンスを介して、任意の SMTP コマンドを挿入される可能性があります。 (1) class.phpmailer.php の validateAddress 関数の電子メールアドレスの CRLF シーケンス (2) class.smtp.php の sendCommand 関数の SMTP コマンドの CRLF シーケンス
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 1, 2015, midnight
Registration Date	Dec. 18, 2015, 5:34 p.m.
Last Update	Dec. 18, 2015, 5:34 p.m.

Affected System

Debian

Debian GNU/Linux 6.0

Debian GNU/Linux 7.0

Debian GNU/Linux 8.0

PHPMailer project

PHPMailer 5.2.14 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8476	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8476
National Vulnerability Database (NVD)
2	CVE-2015-8476	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8476

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3416	http://www.debian.org/security/2015/dsa-3416
GitHub
2	Add test for line breaks in addresses vulnerability	https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0
3	PHPMailer 5.2.14	https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14

Change Log

No	Changed Details	Date of change
0	[2015年12月18日] 掲載	Feb. 17, 2018, 10:37 a.m.