Packagist/zetacomponents/mail CVE-2017-15806: high 8.1, EPSS 10.65%

Zeta Components Mail Arbitrary code execution via a crafted email address

Action: Upgrade zetacomponents/mail to 1.8.2 or later.

composer require zetacomponents/mail:1.8.2

Affected

Fixed versions

Sources

• osv: GHSA-hgr8-g756-vmg9
• https://nvd.nist.gov/vuln/detail/CVE-2017-15806
• https://github.com/zetacomponents/Mail/issues/58
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zetacomponents/mail/CVE-2017-15806.yaml
• https://github.com/zetacomponents/Mail
• https://github.com/zetacomponents/Mail/releases/tag/1.8.2
• https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability
• https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong
• https://www.exploit-db.com/exploits/43155
• http://www.securityfocus.com/bid/101866

CVE-2017-15806 · published 2022-05-17T00:18:44Z · modified 2024-04-23T23:26:47.356627Z · JSON