Description
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-168 php - bypassing safe_mode, CRLF injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030707 [OpenPKG-SA-2003.032] OpenPKG Security Advisory (php) mailing-list
- DSA-168 vendor-advisory
- VU#410609 third-party-advisory
- 20020823 PHP: Bypass safe_mode and inject ASCII control chars with mail() mailing-list
- RHSA-2002:243 vendor-advisory
- 2160 vdb-entry
- RHSA-2003:159 vendor-advisory
- MDKSA-2003:082 vendor-advisory
- 5562 vdb-entry
- php-mail-ascii-injection(9959) vdb-entry
- SuSE-SA:2002:036 vendor-advisory
- CLA-2002:545 vendor-advisory
- RHSA-2002:213 vendor-advisory
- RHSA-2002:248 vendor-advisory
- RHSA-2002:244 vendor-advisory
- RHSA-2002:214 vendor-advisory