Fedora 12: FEDORA-2009-12395 Critical: PEAR Mail Header Issue

PEAR's Mail package defines an interface for implementing mailers under the

PEAR hierarchy. It also provides supporting functions useful to multiple

mailer backends. Currently supported backends include: PHP's native

mail() function, sendmail, and SMTP. This package also provides a RFC822

email address list validation utility class.

Fix CVE-2009-4023, CVE-2009-4111 PEAR's Mail class did not properly escape content of mail header fields, when using the sendmail backend. A remote attacker could send an email message, with specially-crafted headers to local user, leading to disclosure of content and potentially, to modification of arbitrary system file, once the email message was processed by the PEAR's Mail class.