Ubuntu releases security update for Swift Mailer to address remote code execution
A vulnerability in Swift Mailer allows remote attackers to execute arbitrary code via unsanitized email addresses in the mail transport.
Summary
Ubuntu has issued a security notice (USN-8986-1) regarding a critical vulnerability in the Swift Mailer PHP library. The flaw, identified as CVE-2016-10074, stems from improper sanitization of email addresses during the mail transport process.
This vulnerability affects users running the libphp-swiftmailer package on Ubuntu 16.04 LTS. A remote attacker can exploit this defect by providing specially crafted input to pass unauthorized parameters to the underlying mail command, potentially leading to arbitrary code execution on the host system.
Technical details of CVE-2016-10074
- Defect Class: Improper input sanitization within the mail transport component.
- Attack Vector: Remote, unauthenticated exploitation via specially crafted email address strings.
- Impact: Potential for arbitrary code execution through the injection of extra parameters into the system's mail command.
- Fixed Version: The issue is addressed in php-swiftmailer version 5.4.1-1ubuntu1+esm1 for Ubuntu 16.04 LTS.
Why it matters
This update is critical for legacy systems still utilizing Ubuntu 16.04 LTS that rely on Swift Mailer for PHP-based email functionality. System administrators should apply the ESM (Extended Security Maintenance) update to prevent remote compromise of web servers.
What to do
- If you run Ubuntu 16.04 LTS with the libphp-swiftmailer package, update to php-swiftmailer version 5.4.1-1ubuntu1+esm1.
- Run a standard system update to apply the necessary changes.
Original reference: ubuntu.com →