The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and
    2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters
    to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted
    e-mail address. (CVE-2016-10034)

The remote host is affected by the vulnerability described in GLSA-201804-10 (Zend Framework: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Zend Framework that       have remain unaddressed. Please review the referenced CVE identifiers for       details.
  Impact :

    Remote attackers could execute arbitrary commands or conduct SQL       injection attacks.
  Workaround :

    There is no known workaround at this time.

Versions of Zend Framework earlier than 2.4.11 are exposed to a flaw that exists in the 'Zend\Mail\Transport\Sendmai' transport in the zend-mail component that is triggered as input passed via email addresses is not properly sanitized.  This may allow a remote attacker to execute arbitrary commands.

ID	Name	Product	Family	Severity
432538	SCA: security update for zendframework/zend-mail (GHSA-r9mw-gwx9-v3h5)	Tenable Cloud Security	SCA Checks	critical
432538	SCA: security update for zendframework/zend-mail (GHSA-r9mw-gwx9-v3h5)	Tenable Self-Hosted Container Security	SCA Checks	critical
108931	GLSA-201804-10 : Zend Framework: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
9925	Zend Framework < 2.4.11 RCE	Nessus Network Monitor	CGI	critical

Detections

Analytics

CVE-2016-10034

critical

Tenable Plugins

critical

critical

critical

critical