CVE-2016-10074 Swift Mailer mail transport Command Injection
CriticalCVSS 9.8
EPSS 43.8%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| swiftmailer/swiftmailer(Packagist) | < 5.4.5 | 5.4.5 |
| swiftmailer/swiftmailer(Packagist) | = 4.1.3 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = 4.1.4 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = 4.1.5 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = 4.1.6 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = 4.1.7 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v4.1.8 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v4.2.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v4.2.1 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v4.2.2 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v4.3.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v4.3.1 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.0.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.0.1 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.0.2 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.0.3 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.1.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.2.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.2.1 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.2.2 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.3.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.3.1 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.4.0 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.4.1 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.4.2 | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| swiftmailer/swiftmailer(Packagist) | = v5.4.3 | No fix listed |
| swiftmailer/swiftmailer(Packagist) | = v5.4.4 | No fix listed |
| debian/libphp-swiftmailer(Debian:12) | < 5.4.2-1.1 | 5.4.2-1.1 |
| debian/libphp-swiftmailer(Debian:14) | < 5.4.2-1.1 | 5.4.2-1.1 |
| debian/libphp-swiftmailer(Debian:14) | = 4.0.6-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.1.0-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.1.0-2 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.1.2-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.1.3-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.1.5-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.1.5-1~bpo60+1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.2.0-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 4.2.1-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 5.2.1-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 5.2.2-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 5.4.1-1 | No fix listed |
| debian/libphp-swiftmailer(Debian:14) | = 5.4.2-1 | No fix listed |
| swiftmailer/swiftmailer | <= 5.4.4 | No fix listed |
References
- Debian Security Tracker CVE-2016-10074 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com patch vendor-advisory
- legalhackers.com exploit technical-description third-party-advisory
- 40972 exploit third-party-advisory
- 40986 exploit
- 42221 exploit
- packetstormsecurity.com exploit third-party-advisory
- 20161229 SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) exploit mailing-list
- DSA-3769 vendor-advisory
- 95140 third-party-advisory vdb-entry
- github.com