CVE catalog

CVE-2009-4111

php-mail: CVE-2009-4111

[CVE catalog]

Severity
High
Published
Source
[NVD] · [CVE record]
EPSS
1.64% · Oct 25, 2026

Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read and write arbitrary files via a crafted $recipients parameter, and possibly other parameters, a different vulnerability than CVE-2009-4023.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-mailsid2.0.0-0.1fixed
Debianphp-mailforky2.0.0-0.1fixed
Debianphp-mailtrixie2.0.0-0.1fixed
Debianphp-mailbookworm1.4.1-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-mailsourcesid1.1.14-2mediumNot reported[557121]
Debianphp-mailsourceforky1.1.14-2mediumNot reported[557121]
Debianphp-mailsourcetrixie1.1.14-2mediumNot reported[557121]
Debianphp-mailsourcebookworm1.1.14-2mediumNot reported[557121]

[Debian bug #557121]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-mail]Fixed
    Details (2)

    • 1.4.1-1.1 · all · bookworm

      Fixed · Fixed: 1.1.14-2

      dsa · php-mail · debian · bookworm; dsa · php-mail · debian · 12

    • 1.4.1-1.1 · all · bookworm

      Fixed · Fixed: 1.1.14-2

      dsa · php-mail · debian · bookworm; dsa · php-mail · debian · 12

[Debian 13 (Trixie)]

  • [php-mail]Fixed
    Details (2)

    • 2.0.0-0.1 · all · trixie

      Fixed · Fixed: 1.1.14-2

      dsa · php-mail · debian · 13

    • 2.0.0-0.1 · all · trixie

      Fixed · Fixed: 1.1.14-2

      dsa · php-mail · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]