I had a short look at latest changes of PHPMailer

It seems some things are necessary for an attack

• sendmail is used
• path to sendmail binary is invalid
• sender address is invalid

We don't offer users to enter sender address.
Our sender address is config_get( 'return_path_email' );
So we might not be affected.

@dregad, @vboctor
I don't see a big problem in updating PHPMailer.
Do you think it should be included in 1.3.5?

@hanno, thanks for the heads up.

@atrol I tend to agree with your analysis, although the vulnerability report is not detailed enough to be 100% sure.

That being said, having reviewed at the PHPMailer change log since 5.2.15, I don't think anything has been introduced that would cause issues on our side, so I'll update the submodule to be on the safe side, just in case.

Update, there seems to be another vuln in PHPmailer:
https://github.com/PHPMailer/PHPMailer/issues/924

Probably wait for the next update and use that.

there seems to be another vuln in PHPmaile
I am watching it.
The web is full of lurid headlines about this one and the former one at the moment.

Probably wait for the next update and use that.
I still do not see that MantisBT is affected, but who knows ...

From https://github.com/PHPMailer/PHPMailer/issues/924#issuecomment-269452835

Can confirm both CVE-2016-10033 and CVE-2016-10045 are exploitable. 10045 takes a little more thought. Both require that the attacker have control over the sender address

I updated 1.3.x and 2.0.x branches to PHPMailer 5.2.21