CVE-2016-10074
php-swiftmailer: The mail transport (aka Swift_Transport_MailTransport) in Swift Mailerbefore 5.4.5 might allow remote attackers to pa...
CVE-2016-10074 is fixed in 2 products on 1 platform, first by libphp-swiftmailer 5.4.2-1.1, released December 30, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.4379
98th percentile
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailerbefore 5.4.5 might allow remote attackers to pass extra parameters to themail command and consequently execute arbitrary code via a \" (backslashdouble quote) in a crafted e-mail address in the (1) From, (2) ReturnPath,or (3) Sender header.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libphp-swiftmailer · Ubuntu 18.04.6 LTS (bionic) | 5.4.2-1.1 | libphp-swiftmailer 5.4.2-1.1 | Dec 30, 2016 |
| libphp-swiftmailer · Ubuntu 20.04 LTS (focal) | 5.4.2-1.1 | libphp-swiftmailer 5.4.2-1.1 | Dec 30, 2016 |
| php-swiftmailer · Ubuntu 18.04.6 LTS (bionic) | 5.4.2-1.1 | php-swiftmailer 5.4.2-1.1 | Dec 30, 2016 |
| php-swiftmailer · Ubuntu 20.04 LTS (focal) | 5.4.2-1.1 | php-swiftmailer 5.4.2-1.1 | Dec 30, 2016 |
| php-swiftmailer · Ubuntu 24.10 (oracular) | 5.4.2-1.1 | php-swiftmailer 5.4.2-1.1 | Jan 16, 2026 |