UBUNTU-CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

DEBIAN-CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

CVE-2016-10045

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOT...

CVE-2016-10074

Swift Mailer (library: swiftmailer/swiftmailer) is affected by CVE-2016-10074. The mail transport (Swift_Transport_MailTransport) before version 5.4.5 allows remote attackers to pass extra parameters to the mail command, enabling arbitrary code execution via a backslash-double-quote in a crafted ...

CVE-2016-10034

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double...

CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted Sender property...

CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

Zend Framework 'zend-mail' Component Remote Code Execution Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. A remote code execution vulnerability exists in versions of Zend Framework prior to 2.4.11. An attacker can exploit...

CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \” backslash double quote in a crafted Sender property. Recent assessments: Assessed Attacker Value: 0...

Zend Framework / zend-mail < 2.4.11 - Remote Code Execution

09607 09607 09607 See the full advisory URL for the exploit details. / // Attacker's input coming from untrusted source such as $GET , $POST etc. // For example from a Contact form with sender field $emailfrom = '"attacker" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com'; // encoded phpinfo ph...

Updated roundcubemail packages fix security vulnerability

Users can execute commands on the server by writing e-mails, due to insufficient sanitation of the from field when calling PHP's mail function CVE-2016-9920. Note that only roundcubemail installations that don't have an SMTP server configured for mail delivery are affected...

Remote Code Execution when using the mail transport

More info at https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html...

How to Export Contacts from Citrix Secure Mail to Mobile Devices

How to export contacts from Citrix Secure Mail to local contacts on mobile devices...

Debian DSA-3747-1 : exim4 - security update

Bjoern Jacke discovered that Exim, Debian's default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

PHPMailer < 5.2.18 Remote Code Execution（CVE-2016-10033） (PwnScriptum)

来源：https://blog.chaitin.cn/phpmailer-cve-2016-10033/ 作者：phithon@长亭科技 对比一下新老版本： https://github.com/PHPMailer/PHPMailer/compare/v5.2.17...master 其实答案呼之欲出了——和Roundcube的RCE类似，mail函数的第五个参数，传命令参数的地方没有进行转义。...

[SECURITY] [DLA 762-1] exim4 security update

Package : exim4 Version : 4.80-7+deb7u4 CVE ID : CVE-2016-9963 Bjoern Jacke discovered that Exim, Debians default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met. For Debian 7 "Wheezy", these problems have been fixed in version...

[SECURITY] [DSA 3747-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3747-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 25, 2016 https://www.debian.org/security/faq -...

DSA-3747-1 exim4 - security update

Bulletin has no description...

Debian Security Advisory DSA 3747-1 (exim4 - security update)

Bjoern Jacke discovered that Exim, Debian OpenVAS Vulnerability Test $Id: deb3747.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3747-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2016 Greenbone Networks GmbH...