Alerts This Week
Warning Icon 1 924
Alerts This Week
Warning Icon 1 924

Debian 9 Stretch DLA-2306-1 Critical: libphp-phpmailer Escaping Issue

debian lts
Calendar Grey August 2, 2020
Dist Debian Esm H88
A security patch for libphp-phpmailer resolves an issue related to improper escaping that permitted evasion of attachment restrictions in Debian.
It was discovered that there was an escaping issue in libphp-phpmailer, an email generation utility class for the PHP programming language
Topics%20covered

Topics Covered

security advisory Debian escaping issue libphp-phpmailer attachment filter

Summary

The `Content-Type` and `Content-Disposition` headers could have
permitted file attachments that bypassed attachment filters which
match on filename extensions.

For Debian 9 stretch, this problem has been fixed in version
5.2.14+dfsg-2.3+deb9u2.

We recommend that you upgrade your libphp-phpmailer packages.

For the detailed security status of libphp-phpmailer please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/libphp-phpmailer

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: libphp-phpmailer
Version: 5.2.14+dfsg-2.3+deb9u2
CVE ID: CVE-2020-13625
Debian Bug: 962827

Topics%20covered

Topics Covered

security advisory Debian escaping issue libphp-phpmailer attachment filter

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here