CVE-2016-10074
Critical · 9.8CVSS
9.8
EPSS
43.8%
Published
Dec 30, 2016
CISA due date
—
The record
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | swiftmailer/swiftmailer | 0 | 5.4.5 |
| Debian:11 | libphp-swiftmailer | 0 | 5.4.2-1.1 |
| Debian:12 | libphp-swiftmailer | 0 | 5.4.2-1.1 |
| Debian:13 | libphp-swiftmailer | 0 | 5.4.2-1.1 |
| Debian:14 | libphp-swiftmailer | 0 | 5.4.2-1.1 |
| Debian:7 | libphp-swiftmailer | 0 | 4.1.5-1+deb7u1 |
| Debian:8 | libphp-swiftmailer | 0 | 5.2.2-1+deb8u1 |
| Ubuntu:16.04:LTS | libphp-swiftmailer | 0 | No fix |
| Ubuntu:18.04:LTS | libphp-swiftmailer | 0 | 5.4.2-1.1 |
| Ubuntu:20.04:LTS | libphp-swiftmailer | 0 | 5.4.2-1.1 |
| Ubuntu:Pro:16.04:LTS | libphp-swiftmailer | 0 | No fix |
Related vulnerabilities
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77
- CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-77
- CVE-2026-55453 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-77
- CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-77
- CVE-2026-102826 simple-git, an interface for running git commands in any node.js application, enables… CWE-77
- CVE-2026-79945 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77
- CVE-2026-79741 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77
- CVE-2026-78493 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77