{"id":"CVE-2015-8476","aliases":["DEBIAN-CVE-2015-8476","DLA-363-1","DSA-3416-1","EUVD-2020-0337","GHSA-738m-f33v-qc2r","MGASA-2015-0484","UBUNTU-CVE-2015-8476"],"status":"published","title":"SMTP Injection in PHPMailer","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01988,"percentile":0.80744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2015-12-08T00:00:00Z","modified":"2026-09-09T06:47:32Z","fixes":[{"ecosystem":"Packagist","package":"phpmailer/phpmailer","fixed_in":["5.2.14"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libphp-phpmailer","fixed_in":["5.2.14+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libphp-phpmailer","fixed_in":["5.2.14+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libphp-phpmailer","fixed_in":["5.2.14+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libphp-phpmailer","fixed_in":["5.1-1+deb6u11"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libphp-phpmailer","fixed_in":["5.1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libphp-phpmailer","fixed_in":["5.2.9+dfsg-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"php-phpmailer","fixed_in":["5.2.14-1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libphp-phpmailer","fixed_in":["5.1-1+deb6u11build0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmailer/phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1-1+deb6u11"}]}],"versions":["5.1-1"]},{"source":"osv","ecosystem":"Debian:7","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1-1.1"}]}],"versions":["5.1-1"]},{"source":"osv","ecosystem":"Debian:8","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.9+dfsg-2+deb8u1"}]}],"versions":["5.2.9+dfsg-2"]},{"source":"osv","ecosystem":"Packagist","package":"phpmailer/phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.14"}]}],"versions":["v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.2","v5.2.4","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9"]},{"source":"osv","ecosystem":"Mageia:5","package":"php-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.14-1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libphp-phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1-1+deb6u11build0.14.04.1"}]}],"versions":["5.1-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"phpmailer_project","product":"phpmailer"}],"references":[{"url":"https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0","tags":["x_refsource_CONFIRM","x_transferred","fix","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/05/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2015/dsa-3416","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/78619","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/04/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-738m-f33v-qc2r","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8476","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-738m-f33v-qc2r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8476","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0484.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17319","tags":["report"]},{"url":"http://lwn.net/Alerts/667302/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8476","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8476","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","status":"published","published":"2015-12-16T21:00:00Z","modified":"2024-08-06T08:20:42.645Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2020-0337","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","status":"published","published":"2015-12-16T21:00:00Z","modified":"2024-08-06T08:20:42Z","updated_at":"2026-11-03T01:57:26.810911Z"}],"ghsa":[{"id":"GHSA-738m-f33v-qc2r","title":"SMTP Injection in PHPMailer","description":"### Impact\nAttackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.\n\n### Patches\nFixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).\n\n### Workarounds\nManually strip line breaks from email addresses before passing them to PHPMailer.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-8476\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)","status":"published","published":"2020-03-05T22:09:19Z","modified":"2023-01-09T05:02:21Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"nvd":[{"id":"CVE-2015-8476","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","status":"published","published":"2015-12-16T21:59:05.313Z","modified":"2026-06-17T00:34:38.013Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:14.501367Z"}],"osv":[{"id":"CVE-2015-8476","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","status":"published","published":"2015-12-16T21:59:05Z","modified":"2026-04-16T06:23:58.425324214Z","updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8476","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","status":"published","published":"2015-12-16T21:59:05.313Z","modified":"2026-09-09T06:47:32.491924051Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"DLA-363-1","title":"libphp-phpmailer - security update","status":"published","published":"2015-12-08T00:00:00Z","modified":"2026-03-09T01:18:56.306834Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-3416-1","title":"libphp-phpmailer - security update","status":"published","published":"2015-12-13T00:00:00Z","modified":"2026-03-09T01:19:33.632048Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"GHSA-738m-f33v-qc2r","title":"SMTP Injection in PHPMailer","description":"### Impact\nAttackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.\n\n### Patches\nFixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).\n\n### Workarounds\nManually strip line breaks from email addresses before passing them to PHPMailer.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-8476\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)","status":"published","published":"2020-03-05T22:09:19Z","modified":"2024-12-02T05:46:41.550604Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"MGASA-2015-0484","title":"Updated php-phpmailer packages fix CVE-2015-8476","description":"Updated php-phpmailer package fixes security vulnerability:\n\nTakeshi Terada discovered that PHPMailer accepted addresses containing line\nbreaks. This is valid in RFC5322, but allowing such addresses resulted in\ninvalid RFC5321 SMTP commands, permitting a kind of message injection attack\n(CVE-2015-8476).\n","status":"published","published":"2015-12-24T11:08:20Z","modified":"2026-04-16T06:24:06.506867479Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-8476","description":"Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.","status":"published","published":"2015-12-16T21:59:00Z","modified":"2025-07-18T16:43:18Z","updated_at":"2026-11-02T15:54:10.737723Z"}]}}