bugphpGroupWare - Bugs: bug #24725, Security vulnerability in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #24725: Security vulnerability in class.phpmailer.inc.php

Submitter:  Olivier Berger <olberger>
Submitted:  Sun 02 Nov 2008 08:26:18 AM UTC
Item Group: Category:  felamimail
Severity:  3 - Normal Priority:  7 - High
Status:  Invalid Privacy:  Public
Assigned to:  skwashd Open/Closed:  Closed
Component Version:  None Operating System:  None
Reproducibility:  None Planned Release:  None
Fixed Release: 

Mon 10 Nov 2008 12:43:38 AM UTC, comment #3: 

There is no way of exploiting this vulnerability from within phpGroupWare as we only use smtp.  We don't call the use of sendmail.

The version of PHPMailer in trunk is already updated to a new version.  In stable it seems to make little sense as we don't use the vulnerable code.

Dave Hall <skwashd>
Project Administrator
Wed 05 Nov 2008 10:50:56 PM UTC, comment #2: 

<skwashd> phpgw isn't vunerable to the attack
<skwashd> we only use smtp (AFAIK)
<skwashd> at least in the API version

... didn't check myself, and skwashd seems busy with machine outages at the moment...

HtH anyway.

Olivier Berger <olberger>
Sun 02 Nov 2008 04:51:03 PM UTC, comment #1: 

See proposed patch at : http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=13;filename=class.phpmailer.inc.php.patch;att=1;bug=504255

Of course there are updated versions of phpmailer that may be preferred should you want to fix this.

Hope this helps,

Best regards,

Olivier Berger <olberger>
Sun 02 Nov 2008 08:26:18 AM UTC, original submission:  

FYI, a bugreport was filed on phpgroupware in Debian about a security vulnerability in the copy of class.phpmailer.inc.php which is embedded in felamimail.

Here's the report : http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504255

Hope this helps.

Best regards,

Olivier Berger <olberger>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by skwashd (Posted a comment)
  • -email is unavailable- added by olberger (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-11-10 skwashd StatusNone Invalid
        Assigned toNone skwashd
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.9