Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Dec 2016 15:46:50 +0100
From: Hanno Böck <>
Subject: Re: PHPMailer < 5.2.18 Remote Code Execution


Given I had plenty of time on the train to 33c3 I did a quick
lookaround on what contains PHPMailer. As the details of the vuln
aren't clear yet this doesn't necessarily mean they're vulnerable, just
that they ship the affected code.

The most popular webapps that directly ship PHPmailer seem to be Joomla
and Mantis. Both without an update yet.
Wordpress also ships PHPmailer, but this confused me at first. They
renamed it and it's called class-phpmailer.php (if you use some
automatic detection for vulnerable PHPMailer versions - as I do in
freewvs - you may miss that one). Also no update yet.

Drupal doesn't contain PHPMailer, although mentioned in the advisory.
But there are probably plugins and extensions using it. I also saw it
used in some wordpress themes.

Owncloud and CMS Made Simple don't ship PHPMailer in their current
versions, but in older versions. This may deserve some
closer investigation if the files are leftover after updates and pose
still a risk.


Affected popular Webapps with plain PHPMailer:

Affected popular webapps with modified / renamed PHPMailer:

Affected popular webapps which contained PHPMailer in older versions:
CMS Made Simple

Hanno Böck

GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.