CVE-2016-10034 zend-mail remote code execution via Sendmail adapter
CriticalCVSS 9.8
EPSS 38.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zend-mail(Packagist) | < 2.4.11 | 2.4.11 |
| zendframework/zend-mail(Packagist) | = 2.0.3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.0.4 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.0.5 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.0.6 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.0.7 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.0.8 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.4 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.5 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.1.6 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.0rc1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.0rc2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.0rc3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.10 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.4 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.5 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.6 | No fix listed |
Show 52 more
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zend-mail(Packagist) | = 2.2.7 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.8 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.2.9 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.4 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.5 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.6 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.7 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.8 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.3.9 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc4 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc5 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc6 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.0rc7 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.10 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.3 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.4 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.5 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.6 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.7 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.8 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.4.9 | No fix listed |
| zendframework/zend-mail(Packagist) | >= 2.5, <= 2.5.2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.5.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.5.1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.5.2 | No fix listed |
| zendframework/zend-mail(Packagist) | >= 2.6, <= 2.6.2 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.6.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.6.1 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.6.2 | No fix listed |
| zendframework/zend-mail(Packagist) | >= 2.7, < 2.7.2 | 2.7.2 |
| zendframework/zend-mail(Packagist) | = 2.7.0 | No fix listed |
| zendframework/zend-mail(Packagist) | = 2.7.1 | No fix listed |
| zend framework | <= 2.4.10 | No fix listed |
| zend-mail | <= 2.4.10 | No fix listed |
| zend-mail | = 2.5.0 | No fix listed |
| zend-mail | = 2.5.1 | No fix listed |
| zend-mail | = 2.5.2 | No fix listed |
| zend-mail | = 2.6.0 | No fix listed |
| zend-mail | = 2.6.1 | No fix listed |
| zend-mail | = 2.6.2 | No fix listed |
| zend-mail | = 2.7.0 | No fix listed |
| zend-mail | = 2.7.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- framework.zend.com exploit technical-description vendor-advisory
- github.com product
- legalhackers.com exploit technical-description third-party-advisory
- GLSA-201804-10 vendor-advisory
- 40979 exploit
- 40986 exploit
- 42221 exploit
- 95144 third-party-advisory vdb-entry
- 1037539 vdb-entry
- github.com