Description
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-168 php - bypassing safe_mode, CRLF injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030707 [OpenPKG-SA-2003.032] OpenPKG Security Advisory (php) mailing-list
- DSA-168 vendor-advisory
- php-mail-safemode-bypass(9966) vdb-entry
- 20020823 PHP: Bypass safe_mode and inject ASCII control chars with mail() mailing-list
- RHSA-2002:243 vendor-advisory
- RHSA-2003:159 vendor-advisory
- MDKSA-2003:082 vendor-advisory
- SuSE-SA:2002:036 vendor-advisory
- CLA-2002:545 vendor-advisory
- RHSA-2002:213 vendor-advisory
- RHSA-2002:248 vendor-advisory
- RHSA-2002:244 vendor-advisory
- 2111 vdb-entry
- RHSA-2002:214 vendor-advisory