Description
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6 ↗
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj ↗
- https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ/ ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html ↗
- https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html ↗
- https://usn.ubuntu.com/4505-1/ ↗