Bug 790209

Summary:	<www-apps/wordpress-5.7.2: Object injection through through embedded dev-php/PHPMailer (CVE-2020-36326)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~2 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	790203

Description GLSAMaker/CVETool Bot gentoo-dev

2021-05-14 14:01:28 UTC

CVE-2020-36326 (https://nvd.nist.gov/vuln/detail/CVE-2020-36326):
  PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar
  Deserialization via addAttachment with a UNC pathname. NOTE: this is similar
  to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in
  which UNC pathnames were always considered unreadable by PHPMailer, even in
  safe contexts. As an unintended side effect, this fix eliminated the code
  that blocked addAttachment exploitation.

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2021-05-14 14:04:01 UTC

All done (https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=516dae1a577f330b2aac5245cbbf41bd3a18ce15), repository is clean.