libphp-phpmailer

Thor Larholm discovered that libphp-phpmailer, an email transfer class
for PHP, performs insufficient input validition if configured to use
Sendmail. This allows the execution of arbitrary shell commands.

The oldstable distribution (sarge) doesn’t include libphp-phpmailer.

For the stable distribution (etch) this problem has been fixed in
version 1.73-2etch1.

For the unstable distribution (sid) this problem has been fixed in
version 1.73-4.

We recommend that you upgrade your libphp-phpmailer package.