CVE-2016-10034
Critical · 9.8CVSS
9.8
EPSS
38.4%
Published
Dec 30, 2016
CISA due date
—
The record
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | zendframework/zend-mail | 0 | 2.4.11 |
| Packagist | zendframework/zend-mail | 2.5 | No fix |
| Packagist | zendframework/zend-mail | 2.6 | No fix |
| Packagist | zendframework/zend-mail | 2.7 | 2.7.2 |
| Mageia:5 | php-ZendFramework2 | 0 | 2.4.11-1.mga5 |
| packagist | zendframework/zend-mail | 2.4.10 | No fix |
| packagist | zendframework/zend-mail | 2.5.0 | No fix |
| packagist | zendframework/zend-mail | 2.6.0 | No fix |
| packagist | zendframework/zend-mail | 2.7.0 | No fix |
Related vulnerabilities
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77
- CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-77
- CVE-2026-55453 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-77
- CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-77
- CVE-2026-102826 simple-git, an interface for running git commands in any node.js application, enables… CWE-77
- CVE-2026-79945 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77
- CVE-2026-79741 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77
- CVE-2026-78493 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77