p PatchFirst

CVE-2021-3603

CVE-2021-3603 · Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.

CVSS 8.1 · High · EPSS 2.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • phpmailer

    Versions
    • ≥ unspecified, < 6.5.0: Affected (custom)

    Update to 6.5.0

  • libphp-phpmailer Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.6.3-1

    Update to 6.6.3-1

  • libphp-phpmailer Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.6.3-1

    Update to 6.6.3-1

  • libphp-phpmailer Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.6.3-1

    Update to 6.6.3-1

  • phpmailer/phpmailer Packagist

    Versions
    • v5.2.10
    • v5.2.11
    • v5.2.12
    • v5.2.13
    • v5.2.14
    • v5.2.15
    • v5.2.16
    • v5.2.17
    • v5.2.18
    • v5.2.19
    • v5.2.2
    • v5.2.20
    • v5.2.21
    • v5.2.22
    • v5.2.23
    • v5.2.24
    • v5.2.25
    • v5.2.26
    • v5.2.27
    • v5.2.28
    • v5.2.4
    • v5.2.5
    • v5.2.6
    • v5.2.7
    • v5.2.8
    • v5.2.9
    • v6.0.0
    • v6.0.0rc1
    • v6.0.0rc2
    • v6.0.0rc3
    • v6.0.0rc4
    • v6.0.0rc5
    • v6.0.1
    • v6.0.2
    • v6.0.3
    • v6.0.4
    • v6.0.5
    • v6.0.6
    • v6.0.7
    • v6.1.0
    • v6.1.1
    • v6.1.2
    • v6.1.3
    • v6.1.4
    • v6.1.5
    • v6.1.6
    • v6.1.7
    • v6.1.8
    • v6.2.0
    • v6.3.0
    • v6.4.0
    • v6.4.1
    Affected ranges
    • ECOSYSTEM: < 6.5.0

    Update to 6.5.0

  • libphp-phpmailer Ubuntu:Pro:20.04:LTS

    Versions
    • 6.0.6-0.1
    Affected ranges
    • ECOSYSTEM: < 6.0.6-0.1ubuntu0.1~esm1

    Update to 6.0.6-0.1ubuntu0.1~esm1

  • libphp-phpmailer Ubuntu:Pro:22.04:LTS

    Versions
    • 6.2.0-2
    Affected ranges
    • ECOSYSTEM: < 6.2.0-2ubuntu0.1~esm1

    Update to 6.2.0-2ubuntu0.1~esm1

Original sources

Check your server →