# Ubuntu releases security update for Swift Mailer to address remote code execution

> **Key takeaway:** A vulnerability in Swift Mailer allows remote attackers to execute arbitrary code via unsanitized email addresses in the mail transport.

**Published:** 2026-11-03T17:36:26+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-security-update-for-swift-mailer-to-address-.html 

## Summary
Ubuntu has issued a security notice (USN-8986-1) regarding a critical vulnerability in the Swift Mailer PHP library. The flaw, identified as CVE-2016-10074, stems from improper sanitization of email addresses during the mail transport process.

This vulnerability affects users running the libphp-swiftmailer package on Ubuntu 16.04 LTS. A remote attacker can exploit this defect by providing specially crafted input to pass unauthorized parameters to the underlying mail command, potentially leading to arbitrary code execution on the host system.

## Technical details of CVE-2016-10074
- **Defect Class:** Improper input sanitization within the mail transport component.
- **Attack Vector:** Remote, unauthenticated exploitation via specially crafted email address strings.
- **Impact:** Potential for arbitrary code execution through the injection of extra parameters into the system's mail command.
- **Fixed Version:** The issue is addressed in php-swiftmailer version 5.4.1-1ubuntu1+esm1 for Ubuntu 16.04 LTS.

## Why it matters
This update is critical for legacy systems still utilizing Ubuntu 16.04 LTS that rely on Swift Mailer for PHP-based email functionality. System administrators should apply the ESM (Extended Security Maintenance) update to prevent remote compromise of web servers.