Update PHPMailer to 6.5.0 security release

[ayeshrajans]

PHPMailer 6.5 is released a few minutes ago, and contains fixes for an RCE vulnerability discovered in earlier versions. I will submit the changes to a patch, but I think the tests should fail because this release changes the validator, which, IIRC, WordPress overrides.

• Release: ​https://github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0
• Changes: ​https://github.com/PHPMailer/PHPMailer/compare/v6.4.1...v6.5.0

[Synchro]

It's 6.5.0, not 6.5.1. I think you should be OK with the validator change. What it prevents is injecting a simple string function name as a validator, but function injection or closures will continue to work as before, which I understand is how WordPress uses it. I passed this by WP folks on the security-cooperation channel, and they said as much.

[ayeshrajans]

Thank you @Synchro, I indeed had mistakenly typed wrong version number, updating now.

$phpmailer::$validator = static function ( $email ) {
                                return (bool) is_email( $email );
                        };

Apparently this's how the validator is added, so it shouldn't be a problem. I remember there was a ticket on core Trac about the validator failing with the is_email function, and them suggesting to change the validator to something else, hence my suspicious about failing tests.
.
We probably ought to put a dev note about this change

[Synchro]

FWIW, despite one of the issues being an RCE, both are pretty impractical to exploit, so the risk is very low.

[SergeyBiryukov]

In 51169:

External Libraries: Upgrade PHPMailer to version 6.5.0.

Release notes: ​https://github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0

For a full list of changes in this update, see the PHPMailer GitHub:
​https://github.com/PHPMailer/PHPMailer/compare/v6.4.1...v6.5.0

Props ayeshrajans, Synchro.
Fixes #53430.

[SergeyBiryukov]

Reopening for 5.7.3 consideration.

[SergeyBiryukov]

In 51170:

External Libraries: Upgrade PHPMailer to version 6.5.0.

Release notes: ​https://github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0

For a full list of changes in this update, see the PHPMailer GitHub:
​https://github.com/PHPMailer/PHPMailer/compare/v6.4.1...v6.5.0

Props ayeshrajans, Synchro.
Merges [51169] to the 5.7 branch.
Fixes #53430.