==========================================================================
Ubuntu Security Notice USN-5956-2
March 15, 2023

libphp-phpmailer vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM

Summary:

An incomplete fix was discovered in PHPMailer.

Software Description:
- libphp-phpmailer: full featured email transfer class for PHP

Details:

USN-5956-1 fixed vulnerabilities in PHPMailer. It was discovered that the
fix for CVE-2017-11503 was incomplete. This update fixes the problem.

Original advisory details:

  Dawid Golunski discovered that PHPMailer was not properly escaping user
  input data used as arguments to functions executed by the system shell. An
  attacker could possibly use this issue to execute arbitrary code. This
  issue only affected Ubuntu 16.04 ESM. (CVE-2016-10033, CVE-2016-10045)

  It was discovered that PHPMailer was not properly escaping characters
  in certain fields of the code_generator.php example code. An attacker
  could possibly use this issue to conduct cross-site scripting (XSS)
  attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04
  ESM. (CVE-2017-11503)

  Yongxiang Li discovered that PHPMailer was not properly converting
  relative paths provided as user input when adding attachments to messages,
  which could lead to relative image URLs being treated as absolute local
  file paths and added as attachments. An attacker could possibly use this
  issue to access unauthorized resources and expose sensitive information.
  This issue only affected Ubuntu 16.04 ESM. (CVE-2017-5223)

  Sehun Oh discovered that PHPMailer was not properly processing untrusted
  non-local file attachments, which could lead to an object injection. An
  attacker could possibly use this issue to execute arbitrary code. This
  issue only affected Ubuntu 16.04 ESM. (CVE-2018-19296)

  Elar Lang discovered that PHPMailer was not properly escaping file
  attachment names, which could lead to a misinterpretation of file types
  by entities processing the message. An attacker could possibly use this
  issue to bypass attachment filters. This issue was only fixed in Ubuntu
  16.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13625)

  It was discovered that PHPMailer was not properly handling callables in
  its validateAddress function, which could result in untrusted code being
  called should the global namespace contain a function called 'php'. An
  attacker could possibly use this issue to execute arbitrary code. This
  issue was only fixed in Ubuntu 20.04 ESM and Ubuntu 22.04 ESM.
  (CVE-2021-3603)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
   libphp-phpmailer 5.2.14+dfsg-2.3+deb9u2ubuntu0.1~esm2

Ubuntu 16.04 ESM:
   libphp-phpmailer                5.2.14+dfsg-1ubuntu0.1~esm2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-5956-2
   https://ubuntu.com/security/notices/USN-5956-1
   CVE-2017-11503

Package Information: