Description
CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.12 | RHSA-2006:0276 |
| RHEL 3 | php +6 | 4.3.2-30.ent | RHSA-2006:0276 |
Advisories 1
- RHSA-2006:0276 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 20210 third-party-advisory
- TLSA-2006-38 vendor-advisory
- 18198 third-party-advisory
- RHSA-2006:0276 vendor-advisory
- 17763 third-party-advisory
- 18054 third-party-advisory
- oval:org.mitre.oval:def:10332 vdb-entry signature
- http://bugs.php.net/bug.php?id=35307
- http://www.php.net/release_5_1_0.php
- 1015296 vdb-entry
- MDKSA-2005:238 vendor-advisory
- 20951 third-party-advisory
- SUSE-SA:2005:069 vendor-advisory
- 15571 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm
- 19832 third-party-advisory
- php-mbsendmail-header-injection(23270) vdb-entry
- USN-232-1 vendor-advisory
- ADV-2006-2685 vdb-entry