CVE-2002-0986

PHP 4.x-4.2.2 - Mail Header Injection via Unfiltered ASCII Control Characters

Title source: llm
STIX 2.1

Description

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

References (17)

Core 17
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=105760591228031&w=2
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2002/dsa-168
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/410609
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=103011916928204&w=2
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2002-243.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/2160
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2003-159.html
Various Sources vendor-advisory x_refsource_mandrake
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082
Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/5562
Various Sources vendor-advisory x_refsource_caldera
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/9959
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2002_036_modphp4.html
Vendor Advisory vendor-advisory x_refsource_conectiva
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2002-213.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2002-248.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2002-244.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2002-214.html

Scores

EPSS 0.2041
EPSS Percentile 95.6%

Details

Status published
Products (15)
php/php 3.0.18
php/php 4.0
php/php 4.0.1 (3 CPE variants)
php/php 4.0.2
php/php 4.0.3 (2 CPE variants)
php/php 4.0.4
php/php 4.0.5
php/php 4.0.6
php/php 4.0.7
php/php 4.1.0
... and 5 more
Published Sep 24, 2002
Tracked Since Feb 18, 2026