CVE-2005-3883
MEDIUM
5.0
CVSS 2.0
Description
CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument.
Affected products and versions
- PHP versions 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3
References
- bugs.php.net http://bugs.php.net/bug.php?id=35307
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2006-0276.html
- secunia.com http://secunia.com/advisories/17763 Patch, Vendor Advisory
- secunia.com http://secunia.com/advisories/18054
- secunia.com http://secunia.com/advisories/18198
- secunia.com http://secunia.com/advisories/19832
- secunia.com http://secunia.com/advisories/20210
- secunia.com http://secunia.com/advisories/20951
- securitytracker.com http://securitytracker.com/id?1015296
- support.avaya.com http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2005:238
- www.php.net http://www.php.net/release_5_1_0.php Patch
- www.securityfocus.com http://www.securityfocus.com/archive/1/419504/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/15571 Patch
- www.turbolinux.com http://www.turbolinux.com/security/2006/TLSA-2006-38.txt
- www.vupen.com http://www.vupen.com/english/advisories/2006/2685
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/23270
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10332
- www.ubuntu.com https://www.ubuntu.com/usn/usn-232-1/
- nvd.nist.gov Official NVD record