Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 10 php-pear-Mail Update: Critical Mail Header Risk Management

fedora
Calendar Grey December 1, 2009
Dist Fedora Esm H88
Patch for php-pear-Mail to address header encoding vulnerabilities, mitigating risks of external exploits and unauthorized data changes.
Fix CVE-2009-4023, CVE-2009-4111 PEAR's Mail class did not properly escape content of mail header fields, when using the sendmail backend

Summary

PEAR's Mail package defines an interface for implementing mailers under the

PEAR hierarchy. It also provides supporting functions useful to multiple

mailer backends. Currently supported backends include: PHP's native

mail() function, sendmail, and SMTP. This package also provides a RFC822

email address list validation utility class.

Update Information:

Fix CVE-2009-4023, CVE-2009-4111 PEAR's Mail class did not properly escape content of mail header fields, when using the sendmail backend. A remote attacker could send an email message, with specially-crafted headers to local user, leading to disclosure of content and potentially, to modification of arbitrary system file, once the email message was processed by the PEAR's Mail class.

Topics%20covered

Topics Covered

security advisory Fedora remote attack CVE fix mail header

Change Log

* Fri Nov 27 2009 Remi Collet 1.1.14-5 - Fix CVE-2009-4023 (#540842) - rename Mail.xml to php-pear-Mail.xml * Sun Jul 26 2009 Fedora Release Engineering - 1.1.14-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild * Thu Feb 26 2009 Fedora Release Engineering - 1.1.14-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

References


[ 1 ] Bug #540842 - CVE-2009-4023 php-pear-Mail: Absent sanitization of mail header fields https://bugzilla.redhat.com/show_bug.cgi?id=540842

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update php-pear-Mail' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: php-pear-Mail
Product: Fedora 10
Version: 1.1.14
Release: 5.fc10
URL: https://pear.php.net/package/Mail
Summary: Class that provides multiple interfaces for sending emails

Topics%20covered

Topics Covered

security advisory Fedora remote attack CVE fix mail header

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here