Headline
Ubuntu Security Notice USN-5956-1
Ubuntu Security Notice 5956-1 - Dawid Golunski discovered that PHPMailer was not properly escaping user input data used as arguments to functions executed by the system shell. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. It was discovered that PHPMailer was not properly escaping characters in certain fields of the code_generator.php example code. An attacker could possibly use this issue to conduct cross-site scripting attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.
==========================================================================
Ubuntu Security Notice USN-5956-1
March 15, 2023
libphp-phpmailer vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
Summary:
Several security issues were fixed in PHPMailer.
Software Description:
- libphp-phpmailer: full featured email transfer class for PHP
Details:
Dawid Golunski discovered that PHPMailer was not properly escaping user
input data used as arguments to functions executed by the system shell. An
attacker could possibly use this issue to execute arbitrary code. This
issue only affected Ubuntu 16.04 ESM. (CVE-2016-10033, CVE-2016-10045)
It was discovered that PHPMailer was not properly escaping characters
in certain fields of the code_generator.php example code. An attacker
could possibly use this issue to conduct cross-site scripting (XSS)
attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04
ESM. (CVE-2017-11503)
Yongxiang Li discovered that PHPMailer was not properly converting
relative paths provided as user input when adding attachments to messages,
which could lead to relative image URLs being treated as absolute local
file paths and added as attachments. An attacker could possibly use this
issue to access unauthorized resources and expose sensitive information.
This issue only affected Ubuntu 16.04 ESM. (CVE-2017-5223)
Sehun Oh discovered that PHPMailer was not properly processing untrusted
non-local file attachments, which could lead to an object injection. An
attacker could possibly use this issue to execute arbitrary code. This
issue only affected Ubuntu 16.04 ESM. (CVE-2018-19296)
Elar Lang discovered that PHPMailer was not properly escaping file
attachment names, which could lead to a misinterpretation of file types
by entities processing the message. An attacker could possibly use this
issue to bypass attachment filters. This issue was only fixed in Ubuntu
16.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13625)
It was discovered that PHPMailer was not properly handling callables in
its validateAddress function, which could result in untrusted code being
called should the global namespace contain a function called 'php’. An
attacker could possibly use this issue to execute arbitrary code. This
issue was only fixed in Ubuntu 20.04 ESM and Ubuntu 22.04 ESM.
(CVE-2021-3603)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libphp-phpmailer 6.2.0-2ubuntu0.1~esm1
Ubuntu 20.04 LTS:
libphp-phpmailer 6.0.6-0.1ubuntu0.1~esm1
Ubuntu 18.04 LTS:
libphp-phpmailer 5.2.14+dfsg-2.3+deb9u2ubuntu0.1~esm1
Ubuntu 16.04 ESM:
libphp-phpmailer 5.2.14+dfsg-1ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5956-1
CVE-2016-10033, CVE-2016-10045, CVE-2017-11503, CVE-2017-5223,
CVE-2018-19296, CVE-2020-13625, CVE-2021-3603
Package Information:
Related news
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.