Description
CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To parameter, as demonstrated by a parameter containing a "\r\n\t\n" sequence, related to an increment bug in the SKIP_LONG_HEADER_SEP macro.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php4 | 6:4.4.4-9+lenny1 | DTSA-40-1 |
| Debian 5.0 | php5 | 5.2.0-10+lenny1 | DTSA-39-1 |
| Debian 4.0 | php4 | 6:4.4.4-8+etch2 | DSA-1282-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch3 | DSA-1283-1 |
| Debian 3.1 | php4 | 4:4.3.10-20 | DSA-1282-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-11.el5 | RHSA-2007:0153 |
| RHEL 4 | php +13 | 4.3.9-3.22.4 | RHSA-2007:0155 |
| RHEL 3 | php +6 | 4.3.2-40.ent | RHSA-2007:0155 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.6 | RHSA-2007:0162 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP 5.2.1 - Folded Mail Headers Email Header Injection EDB-29784 · remote · Nov 26, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2007:0162 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0155 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0153 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-40-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-39-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1282-1 php4 Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1283-1 php5 Debian Security (DSA / DLA) · Mar 9, 2026
References
- 23145 vdb-entry
- 25056 third-party-advisory
- DSA-1283 vendor-advisory
- oval:org.mitre.oval:def:10951 vdb-entry signature
- GLSA-200705-19 vendor-advisory
- 1017946 vdb-entry
- RHSA-2007:0162 vendor-advisory
- 25062 third-party-advisory
- php-mailfunction-header-injection(33516) vdb-entry
- MDKSA-2007:090 vendor-advisory
- USN-455-1 vendor-advisory
- 24909 third-party-advisory
- MDKSA-2007:087 vendor-advisory
- DSA-1282 vendor-advisory
- http://www.php-security.org/MOPB/MOPB-34-2007.html
- http://us2.php.net/releases/5_2_2.php
- 24924 third-party-advisory
- RHSA-2007:0155 vendor-advisory
- 24965 third-party-advisory
- MDKSA-2007:089 vendor-advisory
- 25445 third-party-advisory
- 25057 third-party-advisory
- SUSE-SA:2007:032 vendor-advisory
- 25025 third-party-advisory
- MDKSA-2007:088 vendor-advisory
- RHSA-2007:0153 vendor-advisory