DLA-326-1 zendframework - security update

Bulletin has no description...

MGASA-2015-0391 Updated php-ZendFramework/php-ZendFramework2 packages fixe security vulnerabilities

Zend Framework contained several instances where it was using incorrect permissions masks, which could lead to local privilege escalation issues CVE-2015-5723. The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as ...

Updated php-ZendFramework/php-ZendFramework2 packages fixe security vulnerabilities

Zend Framework contained several instances where it was using incorrect permissions masks, which could lead to local privilege escalation issues CVE-2015-5723. The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as ...

Debian DSA-3369-1 : zendframework - security update

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework : - CVE-2015-5723 It was discovered that due to incorrect permissions masks when creating directories, local attackers could potentially execute arbitrary code or escalate privileges. - ZF2015-08 no CVE assigned Chris...

Potential SQL injection vector using null byte for PDO (MsSql, SQLite)

More info at https://framework.zend.com/security/advisory/ZF2015-08...

ZendFramework1 -- SQL injection vulnerability

Zend Framework developers report: The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection...

Fedora 20 : php-5.5.21-1.fc20 (2015-1101)

22 Jan 2014, PHP 5.5.21 Core : - Upgraded cryptblowfish to version 1.3. Leigh - Fixed bug 60704 unlink bug with some files path. - Fixed bug 65419 Inside trait, self::class != CLASS. Julien - Fixed bug 65576 Constructor from trait conflicts with inherited constructor. dunglas at gmail dot com -...

Amazon Linux AMI : php-ZendFramework (ALAS-2014-460)

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. CVE-2014-8088 The 1.12.9, 2.2.8, and 2.3.3 releas...

phpTrafficA 2.3 SQL Injection Vulnerability

phpTrafficA versions 2.3 and below suffer from a remote SQL injection vulnerability. Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: An SQL injection exists in Php/Functions/logfunction.php, line...

phpTrafficA 2.3 SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: An SQL injection exists in Php/Functions/logfunction.php, line 933: $sql3 ="INSERT INTO $tablehost SET...

Zend Framework: SQL injection

Background Zend Framework is a high quality and open source framework for developing Web Applications. Description Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Impact A remote attacker could use special...

Medium: php54

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

Fedora 19 : php-5.5.14-1.fc19 (2014-7782)

26 Jun 2014, PHP 5.5.14 Core : - Fixed BC break introduced by patch for bug 67072. Anatol, Stas - Fixed bug 66622 Closures do not correctly capture the late bound class static:: in some cases. Levi Morrison - Fixed bug 67390 insecure temporary file use in the configure script. CVE-2014-3981 Remi ...

Fedora 18 : php-5.4.23-1.fc18 (2013-23215)

28 Nov 2013, PHP 5.4.23 Core : - Fixed bug 66094 unregistertickfunction tries to cast a Closure to a string. Laruence - Fixed bug 65947 basename is no more working after fgetcsv in certain situation. Laruence JSON - Fixed whitespace part of bug 64874 'jsondecode handles whitespace and...

Critical: php

Issue Overview: The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of...

Fedora 18 : php-5.4.17-2.fc18 (2013-12315)

04 Jul 2013, PHP 5.4.17 Core : - Fixed bug 64988 Class loading order affects ESTRICT warning. Laruence - Fixed bug 64966 segfault in zenddofcallcommonhelperSPEC. Laruence - Fixed bug 64960 Segfault in gczvalpossibleroot. Laruence - Fixed bug 64936 doc comments picked up from previous scanner run...

Fedora 17 : php-5.4.17-2.fc17 (2013-12354)

04 Jul 2013, PHP 5.4.17 Core : - Fixed bug 64988 Class loading order affects ESTRICT warning. Laruence - Fixed bug 64966 segfault in zenddofcallcommonhelperSPEC. Laruence - Fixed bug 64960 Segfault in gczvalpossibleroot. Laruence - Fixed bug 64936 doc comments picked up from previous scanner run...

Oracle Linux 5 : php (ELSA-2009-0338)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0338 advisory. - ext/gd: fix overflow2 usage for CVE-2007-3996, CVE-2008-3658 Tenable has extracted the preceding description block directly from the Oracle Linux...

Ubuntu Update for php5 USN-1569-1

Ubuntu Update for Linux kernel vulnerabilities USN-1569-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN15691.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for php5 USN-1569-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Debian Security Advisory DSA 2527-1 (php5)

The remote host is missing an update to php5 announced via advisory DSA 2527-1. OpenVAS Vulnerability Test $Id: deb25271.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2527-1 php5 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...