CVE-2018-19296: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.8v3.1HighModified
AliasesMGASA-2019-0010UBUNTU-CVE-2018-19296DEBIAN-CVE-2018-19296DSA-4351-1
Published 16-11-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-19296 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 2.23% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
2.23%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 16-11-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
High 8.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.23%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.23% on 18-09-2026
18-09-202618-10-2026
EPSS score2.23%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Debian2 products
- libphp-phpmailer< 5.2.14+dfsg-2.4 | < 5.2.14+dfsg-2.3+deb9u1
- debian_linuxEOL8.0 | 9.0
Fedoraproject1 product
- fedoraEOL33 | 34
Mageia1 product
- php-phpmailer< 5.2.27-1.1.mga6
Phpmailer_project1 product
- phpmailer< 5.2.27 | ≥ 6.0.0, < 6.0.6
Ubuntu1 product
- libphp-phpmailer< 5.2.14+dfsg-1ubuntu0.1~esm1 | < 5.2.14+dfsg-2.3+deb9u1build0.18.04.1
Wordpress1 product
- wordpress≥ 3.7, ≤ 5.7
6 vendors · 7 products
References
14 links- github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27X Refsource MISCRelease NotesVendor AdvisoryREPORT
lists.debian.org/debian-lts-announce/2018/12/msg00020.htmlMailing ListX Refsource MLISTThird Party Advisory- github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6X Refsource MISCRelease NotesVendor AdvisoryREPORT