Bug #68776 [NEW]: mail() does not have mail header injection prevention for additional headers

From: yohgaki Operating system: any PHP version: Irrelevant Package: Mail related Bug Type: Bug Bug description:mail() does not have mail header injection prevention for additional headers Description: ------------ mb_send_mail() parses additional headers and stores into hash. During the parse process, invalid headers are discarded. However, mail() simply check \0 and strip trailing \r\n. Therefore, mail() is vulnerable to mail header injections via additional header parameter. -- Edit bug report at https://bugs.php.net/bug.php?id=68776&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68776&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68776&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68776&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68776&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68776&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68776&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68776&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68776&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68776&r=support Expected behavior: https://bugs.php.net/fix.php?id=68776&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68776&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68776&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68776&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68776&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68776&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68776&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68776&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68776&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68776&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68776&r=mysqlcfg