CVE-2016-10074

Publication date 30 December 2016

Last updated 3 November 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

Description

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.

Status

Package Ubuntu Release Status
libphp-swiftmailer 26.10 stonking
Not affected
26.04 LTS resolute
Not affected
25.10 questing Not in release
25.04 plucky Not in release
24.10 oracular
Fixed in 5.4.2-1.1
24.04 LTS noble
Fixed in 5.4.2-1.1
23.10 mantic
Fixed in 5.4.2-1.1
23.04 lunar
Fixed in 5.4.2-1.1
22.10 kinetic
Fixed in 5.4.2-1.1
22.04 LTS jammy
Fixed in 5.4.2-1.1
21.10 impish
Fixed in 5.4.2-1.1
21.04 hirsute
Fixed in 5.4.2-1.1
20.10 groovy
Fixed in 5.4.2-1.1
20.04 LTS focal
Fixed in 5.4.2-1.1
19.10 eoan
Fixed in 5.4.2-1.1
19.04 disco
Fixed in 5.4.2-1.1
18.10 cosmic
Fixed in 5.4.2-1.1
18.04 LTS bionic
Fixed in 5.4.2-1.1
17.10 artful Ignored end of life
17.04 zesty Ignored end of life
16.10 yakkety Ignored end of life
16.04 LTS xenial
Fixed in 5.4.1-1ubuntu1+esm1
14.04 LTS trusty Not in release
12.04 LTS precise Ignored end of life

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.8 · Critical

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-8986-1
    • Swift Mailer vulnerability
    • 3 November 2026

Other references

Access our resources on patching vulnerabilities