On this page (7 sections)
Ubuntu has published notice USN-8986-1 for Swift Mailer, a PHP mail library. The notice describes a flaw in how the library handled e-mail addresses in its mail transport, which could let a remote attacker run code under certain conditions. It is tracked as CVE-2016-10074.
If you run PHP applications on Ubuntu 16.04 LTS that send mail through Swift Mailer, or you maintain servers that do, this update is for you. Only one publisher, Ubuntu, covers this so far, so this article sticks to what that notice states.
What happened
Ubuntu's notice says security researcher Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. According to Ubuntu, a remote attacker could possibly use this to pass extra parameters to the mail command and execute arbitrary code.
Ubuntu summarizes the risk as Swift Mailer being made to run programs if it received specially crafted input. The notice does not say whether the flaw is being exploited, and it does not assign a severity score.
Why this kind of flaw matters
The weakness class is improper input sanitization. When an application hands text to a command without cleaning it, the command can interpret that text as extra options rather than as plain data. Here, Ubuntu says the unsanitized value is an e-mail address and the command is the mail command.
That is why a web form that looks harmless can matter. Any feature that takes an address from a visitor and passes it to the library, such as a contact form, sign-up or account recovery, is a possible entry point. The notice does not describe specific exploit conditions, so treat any exposed form that feeds addresses into Swift Mailer as in scope until the package is updated.
Who is affected
- Ubuntu 16.04 LTS systems with the libphp-swiftmailer package installed, the only release listed in the notice.
- Sites and applications that bundle their own copy of Swift Mailer inside their code (for example via a PHP dependency manager). The Ubuntu notice covers the distribution package only, so a bundled copy would not be fixed by the system update. Check your application's own dependencies and its vendor's advisories.
- Applications configured to use the library's mail transport, as opposed to other transports. The notice names the mail transport specifically.
How to check your exposure
This command lists installed packages whose names contain swiftmailer, with their versions. Run it on the server; a version older than 5.4.1-1ubuntu1+esm1 on Ubuntu 16.04 LTS needs updating.
dpkg -l | grep -i swiftmailerThe notice names the fixed package as php-swiftmailer. This command shows the installed and candidate versions for that package name, so you can see whether an update is waiting.
apt-cache policy php-swiftmailerTo find copies bundled inside applications, search your web roots for the library's directory name. This is a read-only search; adjust the path to where your sites live.
find /var/www -type d -iname 'swiftmailer*' 2>/dev/nullWhat to do now
Ubuntu says a standard system update makes the necessary changes. On Ubuntu 16.04 LTS the fixed build carries an +esm1 suffix, and the notice points to Ubuntu Pro for extended security coverage, which it says is free for up to five machines.
This command refreshes the package index and upgrades only php-swiftmailer. Afterward, re-run the version check above and confirm it shows 5.4.1-1ubuntu1+esm1 or newer.
sudo apt-get update
sudo apt-get install --only-upgrade php-swiftmailer0 of 6 done
Detection and monitoring
The research gives no indicators of compromise, so there is no signature to hunt for. Reasonable general checks are to review web server and mail logs for unusual or malformed address values submitted to forms, unexpected outbound mail volume, and new or modified files in web directories after the date you learned of the issue.
If you suspect a server was abused, follow a standard response: isolate it, preserve logs, rotate credentials, and rebuild from a clean source. Our guides on checking whether a website is hacked and what to do after a hack walk through this. For an outside-in look at your site, the free malware scanner can help, though it cannot see inside the server.
For other recent Ubuntu notices, see our write-ups on USN-8991-1 for rxvt-unicode and USN-8973-1 for libmspack.
Timeline
| Date | Event |
|---|---|
| 3 November 2026 | Ubuntu publishes USN-8986-1 for Swift Mailer, referencing CVE-2016-10074 |
The research does not give the original disclosure date of the underlying issue or any exploitation timeline.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.