phpGroupWare - Bugs: bug #24725, Security vulnerability in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #24725: Security vulnerability in class.phpmailer.inc.php
Submitter: | Olivier Berger <olberger> | ||
Submitted: | Sun 02 Nov 2008 08:26:18 AM UTC | ||
Category: | felamimail | Item Group: | 0.9.16.012 |
Severity: | 3 - Normal | Priority: | 7 - High |
Status: | Invalid | Privacy: | Public |
Assigned to: | skwashd | Open/Closed: | Closed |
Component Version: | None | Operating System: | None |
Reproducibility: | None | Planned Release: | None |
Fixed Release: |
Mon 10 Nov 2008 12:43:38 AM UTC, comment #3: |
Dave Hall <skwashd> |
Wed 05 Nov 2008 10:50:56 PM UTC, comment #2: <skwashd> phpgw isn't vunerable to the attack
|
Olivier Berger <olberger> |
Sun 02 Nov 2008 04:51:03 PM UTC, comment #1: See proposed patch at : http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=13;filename=class.phpmailer.inc.php.patch;att=1;bug=504255
|
Olivier Berger <olberger> |
Sun 02 Nov 2008 08:26:18 AM UTC, original submission:
FYI, a bugreport was filed on phpgroupware in Debian about a security vulnerability in the copy of class.phpmailer.inc.php which is embedded in felamimail.
|
Olivier Berger <olberger> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2008-11-10 | skwashd | Status | None | Invalid | |
Assigned to | None | skwashd | |||
Open/Closed | Open | Closed |
Powered by Savane 3.13-caa5.
Corresponding source code
There is no way of exploiting this vulnerability from within phpGroupWare as we only use smtp. We don't call the use of sendmail.
The version of PHPMailer in trunk is already updated to a new version. In stable it seems to make little sense as we don't use the vulnerable code.