Debian Security Advisory 1315-1 – Thor Larholm discovered that libphp-phpmailer, an email transfer class for PHP, performs insufficient input validation if configured to use Sendmail. This allows the execution of arbitrary shell commands.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/57247/dsa-1315-1.txt
Source: https://packetstormsecurity.com/files/57247/Debian-Linux-Security-Advisory-1315-1.html