**バージョン 5.2.27**

  - セキュリティ オブジェクトインジェクションの脆弱性を修正します。
    **CVE-2018-19296**。cyberone.krのSehun Oh氏による報告。

注意： 5.2ブランチは廃止予定であり、2018年12月31日以降はセキュリティ更新プログラムを受信しません。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

**バージョン 6.0.6**

  - **セキュリティ** オブジェクトインジェクションの脆弱性を修正します。**CVE-2018-19296**。cyberone.krのSehun Oh氏による報告。

  - タガログ語翻訳を追加しました。StoneArtzに感謝の意を表します

  - マラガッシュ語翻訳を追加しました。Hackinet氏に感謝の意を表します

  - セルビア語翻訳を更新し、不適切な言語コードを修正しました。mmilanovic4に感謝の意を表します

  - アラビア語の翻訳を更新しました（MicroDroid）

  - ハンガリー語翻訳を更新しました

  - オランダ語翻訳を更新しました

  - スロベニア語翻訳を更新しました（filips123）

  - スロバキア語翻訳を更新しました（pcmanik）

  - イタリア語翻訳を更新しました（sabas）

  - ノルウェー語翻訳を更新しました（aleskr）

  - インドネシア語翻訳を更新しました（mylastof）

  -  text/htmlやquoted-printableなどの一般的な値に定数を追加し、それらを使用します

  - デバッグを支援するDKIMのコピーされたヘッダーのサポート、およびDKIM署名に余分なヘッダーを追加するオプションを追加しました。これらの使用方法については、DKIM_signの例を参照してください。gwi-mmuthsに感謝の意を表します。

  - Campaign MonitorトランザクションIDパターン照合機能を追加します

  - PHP 7.3で警告を引き起こしている廃止された定数およびini値を削除し、PHP7.3ビルドをTravis構成に追加しました。

  - テスト範囲の拡大しました

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

**Version 6.0.6**

  - **SECURITY** Fix potential object injection     vulnerability. **CVE-2018-19296**. Reported by Sehun Oh     of cyberone.kr.

  - Added Tagalog translation, thanks to StoneArtz

  - Added Malagache translation, thanks to Hackinet

  - Updated Serbian translation, fixed incorrect language     code, thanks to mmilanovic4

  - Updated Arabic translations (MicroDroid)

  - Updated Hungarian translations

  - Updated Dutch translations

  - Updated Slovenian translation (filips123)

  - Updated Slovak translation (pcmanik)

  - Updated Italian translation (sabas)

  - Updated Norwegian translation (aleskr)

  - Updated Indonesian translation (mylastof)

  - Add constants for common values, such as text/html and     quoted-printable, and use them

  - Added support for copied headers in DKIM, helping with     debugging, and an option to add extra headers to the     DKIM signature. See DKIM_sign example for how to use     them. Thanks to gwi-mmuths.

  - Add Campaign Monitor transaction ID pattern matcher

  - Remove deprecated constant and ini values causing     warnings in PHP 7.3, added PHP 7.3 build to Travis     config.

  - Expanded test coverage

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that PHPMailer, a library to send email from PHP applications, is prone to a PHP object injection vulnerability, potentially allowing a remote attacker to execute arbitrary code.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2731 advisory.

    One security issue affects WordPress, a weblog manager, versions between 3.7 and 5.7. This update fixes     the following security issues: Object injection in PHPMailer (CVE-2020-36326 and CVE-2018-19296). For     Debian 9 stretch, this problem has been fixed in version 4.7.21+dfsg-0+deb9u1. We recommend that you     upgrade your wordpress packages. For the detailed security status of wordpress please refer to its     security tracker page at: https://security-tracker.debian.org/tracker/wordpress Further information about     Debian LTS security advisories, how to apply these updates to your system and frequently asked questions     can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5956-1 advisory.

    Dawid Golunski discovered that PHPMailer was not properly escaping user input data used as arguments to     functions executed by the system shell. An attacker could possibly use this issue to execute arbitrary     code. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-10033, CVE-2016-10045)

    It was discovered that PHPMailer was not properly escaping characters in certain fields of the     code_generator.php example code. An attacker could possibly use this issue to conduct cross-site scripting     (XSS) attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2017-11503)

    Yongxiang Li discovered that PHPMailer was not properly converting relative paths provided as user input     when adding attachments to messages, which could lead to relative image URLs being treated as absolute     local file paths and added as attachments. An attacker could possibly use this issue to access     unauthorized resources and expose sensitive information. This issue only affected Ubuntu 16.04 ESM.
    (CVE-2017-5223)

    Sehun Oh discovered that PHPMailer was not properly processing untrusted non-local file attachments, which     could lead to an object injection. An attacker could possibly use this issue to execute arbitrary code.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2018-19296)

    Elar Lang discovered that PHPMailer was not properly escaping file attachment names, which could lead to a     misinterpretation of file types by entities processing the message. An attacker could possibly use this     issue to bypass attachment filters. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
    (CVE-2020-13625)

    It was discovered that PHPMailer was not properly handling callables in its validateAddress function,     which could result in untrusted code being called should the global namespace contain a function called     'php'. An attacker could possibly use this issue to execute arbitrary code. This issue was only fixed in     Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-3603)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**Version 5.2.27**

  - SECURITY Fix potential object injection vulnerability.
    **CVE-2018-19296**. Reported by Sehun Oh of cyberone.kr.

Note that the 5.2 branch is deprecated and will not receive security updates after 31st December 2018.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SO-AND-SO reports :

CVE-2018-19296:Fix potential object injection vulnerability.

A possible regression was found in the recent security update for libphp-phpmailer, announced as DLA 1591-1. During backporting a new variable have accidentally introduced to a conditional statement from a much later version. Thanks to Salvatore Bonaccorso (carnil) for reporting this.

For Debian 8 'Jessie', this problem has been fixed in version 5.2.9+dfsg-2+deb8u5.

We recommend that you upgrade your libphp-phpmailer packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119159	Fedora 27：php-PHPMailer（2018-daee493feb）	Nessus	Fedora Local Security Checks	2018/11/27	2024/7/19	high
120921	Fedora 28：php-PHPMailer（2018-f73869d61e）	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	high
120237	Fedora 28：php-phpmailer6（2018-0f5e6e9957）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	high
119155	Fedora 27 : php-phpmailer6 (2018-46b92c9064)	Nessus	Fedora Local Security Checks	2018/11/27	2024/7/19	high
119508	Debian DSA-4351-1 : libphp-phpmailer - security update	Nessus	Debian Local Security Checks	2018/12/10	2024/7/16	high
120257	Fedora 29 : php-phpmailer6 (2018-18f3eff32b)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	high
152214	Debian DLA-2731-1 : wordpress - LTS security update	Nessus	Debian Local Security Checks	2021/8/4	2025/1/24	critical
172589	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : PHPMailer vulnerabilities (USN-5956-1)	Nessus	Ubuntu Local Security Checks	2023/3/15	2025/9/3	critical
120237	Fedora 28 : php-phpmailer6 (2018-0f5e6e9957)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	high
120666	Fedora 29 : php-PHPMailer (2018-a2e9bd6eae)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	high
120921	Fedora 28 : php-PHPMailer (2018-f73869d61e)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	high
119109	FreeBSD : phpmailer -- Multiple vulnerability (b036faba-edd8-11e8-b3b7-00e04c1ea73d)	Nessus	FreeBSD Local Security Checks	2018/11/23	2024/7/19	high
119119	Debian DLA-1591-2 : libphp-phpmailer regression update	Nessus	Debian Local Security Checks	2018/11/26	2024/7/19	high
119159	Fedora 27 : php-PHPMailer (2018-daee493feb)	Nessus	Fedora Local Security Checks	2018/11/27	2024/7/19	high

检测

插件搜索

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high