Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 3 articles for you...
197
security advisorysoftware updatedebianDebian 9: DLA-2731-1 Moderate: WordPress Object Injection Fix
One security issue affects WordPress, a weblog manager, versions between 3.7 and 5.7. This update fixes the following security issues: Object injection in PHPMailer (CVE-2020-36326 and CVE-2018-19296). . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2731-1
Aug 04, 2021
Debian LTS
89
security advisoryfedoracriticalFedora: 2021-ecf4fed550 Critical: PhpMailer Object Injection Fix
**Version 6.4.1** (April 29th, 2021) * **SECURITY** Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details * Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as `ssh2` * Ensure method signature consistency in `doCallback` calls * Ukrainian language update * Add. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-ecf4fed550 2021-05-12 16:12:14.610254 --------------------------------------------------------------------------------Name : php-phpmailer6 Product : Fedora 33 Version : 6.4.1 Release : 1.fc33 URL : https://github.com/PHPMailer/PHPMailer Summary : Full-featured email creation and transfer class for PHP Description : PHPMailer - A full-featured email creation and transfer class for PHP Class Features * Probably the world's most popular code for sending email from PHP! * Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more * Integrated SMTP support - send without a local mail server * Send emails with multiple To, CC, BCC and Reply-to addresses * Multipart/alternative emails for mail clients that do not read HTML email * Add attachments, including inline * Support for UTF-8 content and 8bit, base64, binary, and quoted-printable encodings * SMTP authentication with LOGIN, PLAIN, CRAM-MD5 and XOAUTH2 mechanisms over SSL and SMTP+STARTTLS transports * Validates email addresses automatically * Protect against header injection attacks * Error messages in 47 languages! * DKIM and S/MIME signing support * Compatible with PHP 5.5 and later * Namespaced to prevent name clashes * Much more! Autoloader: /usr/share/php/PHPMailer/PHPMailer6/autoload.php --------------------------------------------------------------------------------Update Information: **Version 6.4.1** (April 29th, 2021) * **SECURITY** FixesCVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details * Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as `ssh2` * Ensure method signature consistency in `doCallback` calls * Ukrainian language update * Add composer scripts for checking coding standards and running tests --------------------------------------------------------------------------------ChangeLog: * Mon May 3 2021 Remi Collet - 6.4.1-1 - update to 6.4.1 --------------------------------------------------------------------------------References: [ 1 ] Bug #1955757 - CVE-2020-36326 php-phpmailer6: Object injection through Phar Deserialization via addAttachment with a UNC pathname [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1955757 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-ecf4fed550' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 12, 2021
•Critical
Fedora
89
security advisorycriticalFedoraFedora 34: FEDORA-2021-b21bbfa198 Critical: PhpMailer Input Manipulation
**Version 6.4.1** (April 29th, 2021) * **SECURITY** Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details * Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as `ssh2` * Ensure method signature consistency in `doCallback` calls * Ukrainian language update * Add. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-b21bbfa198 2021-05-12 05:41:31.251870 --------------------------------------------------------------------------------Name : php-phpmailer6 Product : Fedora 34 Version : 6.4.1 Release : 1.fc34 URL : https://github.com/PHPMailer/PHPMailer Summary : Full-featured email creation and transfer class for PHP Description : PHPMailer - A full-featured email creation and transfer class for PHP Class Features * Probably the world's most popular code for sending email from PHP! * Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more * Integrated SMTP support - send without a local mail server * Send emails with multiple To, CC, BCC and Reply-to addresses * Multipart/alternative emails for mail clients that do not read HTML email * Add attachments, including inline * Support for UTF-8 content and 8bit, base64, binary, and quoted-printable encodings * SMTP authentication with LOGIN, PLAIN, CRAM-MD5 and XOAUTH2 mechanisms over SSL and SMTP+STARTTLS transports * Validates email addresses automatically * Protect against header injection attacks * Error messages in 47 languages! * DKIM and S/MIME signing support * Compatible with PHP 5.5 and later * Namespaced to prevent name clashes * Much more! Autoloader: /usr/share/php/PHPMailer/PHPMailer6/autoload.php --------------------------------------------------------------------------------Update Information: **Version 6.4.1** (April 29th, 2021) * **SECURITY** FixesCVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details * Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as `ssh2` * Ensure method signature consistency in `doCallback` calls * Ukrainian language update * Add composer scripts for checking coding standards and running tests --------------------------------------------------------------------------------ChangeLog: * Mon May 3 2021 Remi Collet - 6.4.1-1 - update to 6.4.1 --------------------------------------------------------------------------------References: [ 1 ] Bug #1955757 - CVE-2020-36326 php-phpmailer6: Object injection through Phar Deserialization via addAttachment with a UNC pathname [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1955757 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-b21bbfa198' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 12, 2021
•Critical
Fedora
87
security advisoryremote code executiondebianDebian: DSA-4378-1 Moderate: PHP PEAR Archive_Tar Object Injection
Fariskhi Vidyan discovered that the PEAR Archive_Tar package for handling tar files in PHP is prone to a PHP object injection vulnerability, potentially allowing a remote attacker to execute arbitrary code. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4378-1
Jan 30, 2019
Debian
203
security advisorymoderatesecurity issueMageia 6 MGASA-2019-0010 Moderate: php-phpmailer Object Injection
Potential object injection vulnerability (CVE-2018-19296). References: - https://bugs.mageia.org/show_bug.cgi?id=24055 - https://lists.fedoraproject.org/archives/list/
Jan 05, 2019
Mageia
89
security advisoryFedorasecurity fixFedora: FEDORA-2018-0f5e6e9957 moderate: php-phpmailer6 object injection
**Version 6.0.6** * **SECURITY** Fix potential object injection vulnerability. **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr. * Added Tagalog translation, thanks to StoneArtz * Added Malagache translation, thanks to Hackinet * Updated Serbian translation, fixed incorrect language code, thanks to mmilanovic4 * Updated Arabic translations (MicroDroid) *. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-0f5e6e9957 2018-11-27 17:11:25.740584 --------------------------------------------------------------------------------Name : php-phpmailer6 Product : Fedora 28 Version : 6.0.6 Release : 1.fc28 URL : https://github.com/PHPMailer/PHPMailer Summary : Full-featured email creation and transfer class for PHP Description : PHPMailer - A full-featured email creation and transfer class for PHP Class Features * Probably the world's most popular code for sending email from PHP! * Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more * Integrated SMTP support - send without a local mail server * Send emails with multiple To, CC, BCC and Reply-to addresses * Multipart/alternative emails for mail clients that do not read HTML email * Add attachments, including inline * Support for UTF-8 content and 8bit, base64, binary, and quoted-printable encodings * SMTP authentication with LOGIN, PLAIN, CRAM-MD5 and XOAUTH2 mechanisms over SSL and SMTP+STARTTLS transports * Validates email addresses automatically * Protect against header injection attacks * Error messages in 47 languages! * DKIM and S/MIME signing support * Compatible with PHP 5.5 and later * Namespaced to prevent name clashes * Much more! Autoloader: /usr/share/php/PHPMailer/PHPMailer6/autoload.php --------------------------------------------------------------------------------Update Information: **Version 6.0.6** * **SECURITY** Fix potential objectinjection vulnerability. **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr. * Added Tagalog translation, thanks to StoneArtz * Added Malagache translation, thanks to Hackinet * Updated Serbian translation, fixed incorrect language code, thanks to mmilanovic4 * Updated Arabic translations (MicroDroid) * Updated Hungarian translations * Updated Dutch translations * Updated Slovenian translation (filips123) * Updated Slovak translation (pcmanik) * Updated Italian translation (sabas) * Updated Norwegian translation (aleskr) * Updated Indonesian translation (mylastof) * Add constants for common values, such as text/html and quoted-printable, and use them * Added support for copied headers in DKIM, helping with debugging, and an option to add extra headers to the DKIM signature. See DKIM_sign example for how to use them. Thanks to gwi-mmuths. * Add Campaign Monitor transaction ID pattern matcher * Remove deprecated constant and ini values causing warnings in PHP 7.3, added PHP 7.3 build to Travis config. * Expanded test coverage --------------------------------------------------------------------------------ChangeLog: * Fri Nov 16 2018 Remi Collet - 6.0.6-1 - update to 6.0.6 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-0f5e6e9957' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 27, 2018
Fedora
89
security advisoryFedorasecurity fixFedora 28: FEDORA-2018-f73869d61e Critical: PHP-PHPMailer Object Injection
**Version 5.2.27** * SECURITY Fix potential object injection vulnerability. **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr. Note that the 5.2 branch is deprecated and will not receive security updates after 31st December 2018.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-f73869d61e 2018-11-27 17:11:25.740573 --------------------------------------------------------------------------------Name : php-PHPMailer Product : Fedora 28 Version : 5.2.27 Release : 1.fc28 URL : https://github.com/PHPMailer/PHPMailer Summary : PHP email transport class with a lot of features Description : Full Featured Email Transfer Class for PHP. PHPMailer features: * Supports emails digitally signed with S/MIME encryption! * Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs * Works on any platform. * Supports Text & HTML emails. * Embedded image support. * Multipart/alternative emails for mail clients that do not read HTML email. * Flexible debugging. * Custom mail headers. * Redundant SMTP servers. * Support for 8bit, base64, binary, and quoted-printable encoding. * Word wrap. * Multiple fs, string, and binary attachments (those from database, string, etc). * SMTP authentication. * Tested on multiple SMTP servers: Sendmail, qmail, Postfix, Gmail, Imail, Exchange, etc. * Good documentation, many examples included in download. * It's swift, small, and simple. --------------------------------------------------------------------------------Update Information: **Version 5.2.27** * SECURITY Fix potential object injection vulnerability. **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr. Note that the 5.2 branch is deprecated and will not receive security updates after 31st December 2018. --------------------------------------------------------------------------------ChangeLog: * Fri Nov 162018 Remi Collet - 5.2.27-1 - update to 5.2.27 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-f73869d61e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 27, 2018
•Critical
Fedora
89
security advisorycriticalFedoraFedora 29: 2018-18f3eff32b Critical: php-phpmailer6 Object Injection
**Version 6.0.6** * **SECURITY** Fix potential object injection vulnerability. **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr. * Added Tagalog translation, thanks to StoneArtz * Added Malagache translation, thanks to Hackinet * Updated Serbian translation, fixed incorrect language code, thanks to mmilanovic4 * Updated Arabic translations (MicroDroid) *. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-18f3eff32b 2018-11-27 03:30:06.112910 --------------------------------------------------------------------------------Name : php-phpmailer6 Product : Fedora 29 Version : 6.0.6 Release : 1.fc29 URL : https://github.com/PHPMailer/PHPMailer Summary : Full-featured email creation and transfer class for PHP Description : PHPMailer - A full-featured email creation and transfer class for PHP Class Features * Probably the world's most popular code for sending email from PHP! * Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more * Integrated SMTP support - send without a local mail server * Send emails with multiple To, CC, BCC and Reply-to addresses * Multipart/alternative emails for mail clients that do not read HTML email * Add attachments, including inline * Support for UTF-8 content and 8bit, base64, binary, and quoted-printable encodings * SMTP authentication with LOGIN, PLAIN, CRAM-MD5 and XOAUTH2 mechanisms over SSL and SMTP+STARTTLS transports * Validates email addresses automatically * Protect against header injection attacks * Error messages in 47 languages! * DKIM and S/MIME signing support * Compatible with PHP 5.5 and later * Namespaced to prevent name clashes * Much more! Autoloader: /usr/share/php/PHPMailer/PHPMailer6/autoload.php --------------------------------------------------------------------------------Update Information: **Version 6.0.6** * **SECURITY** Fix potential objectinjection vulnerability. **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr. * Added Tagalog translation, thanks to StoneArtz * Added Malagache translation, thanks to Hackinet * Updated Serbian translation, fixed incorrect language code, thanks to mmilanovic4 * Updated Arabic translations (MicroDroid) * Updated Hungarian translations * Updated Dutch translations * Updated Slovenian translation (filips123) * Updated Slovak translation (pcmanik) * Updated Italian translation (sabas) * Updated Norwegian translation (aleskr) * Updated Indonesian translation (mylastof) * Add constants for common values, such as text/html and quoted-printable, and use them * Added support for copied headers in DKIM, helping with debugging, and an option to add extra headers to the DKIM signature. See DKIM_sign example for how to use them. Thanks to gwi-mmuths. * Add Campaign Monitor transaction ID pattern matcher * Remove deprecated constant and ini values causing warnings in PHP 7.3, added PHP 7.3 build to Travis config. * Expanded test coverage --------------------------------------------------------------------------------ChangeLog: * Fri Nov 16 2018 Remi Collet - 6.0.6-1 - update to 6.0.6 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-18f3eff32b' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 27, 2018
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!