CVE-2015-8476
Last modified
CVE-2015-8476 is a vulnerability of currently unknown severity. Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.. EPSS estimates a 1.99% chance of exploitation in the next 30 days.
Description
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 6.0 |
| Debian | Debian Linux | 7.0 |
| Debian | Debian Linux | 8.0 |
| Phpmailer Project | Phpmailer | <= 5.2.13 |
References
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14Vendor Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-8476?
How severe is CVE-2015-8476?
How do I fix CVE-2015-8476?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-8466Swift3 before 1.9 allows remote attackers to conduct replay …
- CVE-2015-8467The samldb_check_user_account_control_acl function in dsdb/s…7.5
- CVE-2015-8470The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x …
- CVE-2015-8472Buffer overflow in the png_set_PLTE function in libpng befor…
- CVE-2015-8473The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, …
- CVE-2015-8474Open redirect vulnerability in the valid_back_url function i…
- CVE-2015-8477Cross-site scripting (XSS) vulnerability in Redmine before 2…
- CVE-2015-8478Multiple unspecified vulnerabilities in Google V8 before 4.7…
- CVE-2015-8479Use-after-free vulnerability in the AudioOutputDevice::OnDev…
- CVE-2015-8480The VideoFramePool::PoolImpl::CreateFrame function in media/…
- CVE-2015-8481Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bund…
- CVE-2015-8482Blue Coat Unified Agent before 4.6.2 does not prevent modifi…
Are you affected by CVE-2015-8476?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST