Fedora Update for php-zendframework-zend-http FEDORA-2018-71e9650fa9

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-1403-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1403-1 : zendframework security update

CVE-2016-4861 Allowing remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from a SQL statement before validation. For Debian 8 'Jessie', these problems have been fixed in version 1.12.9+dfsg-2+deb8u7. We recommend that you upgrade your zendframework package...

[SECURITY] [DLA 1403-1] zendframework security update

Package : zendframework Version : 1.12.9+dfsg-2+deb8u7 CVE ID : CVE-2016-4861 CVE-2016-4861 Allowing remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation. For Debian 8 "Jessie", these problems have been fixed in version...

DLA-1403-1 zendframework - security update

Bulletin has no description...

XML External Entity (XXE) Processing

zendframework/zend-json is susceptible to XML external entity XXE processing attacks. The attacks can be triggered because when loading an XML formatted string into a Simple XML Element object. The fromXml function in Json.php does not validate the XML formatted string properly...

XML External Entity (XXE) Processing

zendframework is vulnerable to XML external entity XXE processing attacks. The attacks exist because it fails to scan the validity of XML input when loading XML...

Information Disclosure

Zendframework and zend-crypt are vulnerable to information disclosure attacks. The library uses the default php $padding which is vulnerable to Bleichenbacher's chosen-ciphertext attack that can be used to decrypt arbitrary ciphertext...

Session Validation Bypass

Zendframwork is vulnerable to session validation bypass. If the session validator is set up prior to the start of a session, it will not have any validator metadata attached, causing the application to rebuild the metadata and mark the current session as valid...

XML External Entity (XXE) Attacks

Zendframework and several Zendservices are vulnerable to XML External Entity XXE attacks. The libxmldisableentityloader is not correctly shared between threads then PHP-FPM is used, allowing attackers to conduct XXE attacks. This is as a result of an incomplete fix for CVE-2012-5657...

Authentication Bypass

zendframework/zendframework1 and zendframework/zendopenid are vulnerable to authentication bypass. The consumer classes only ensure that at least one field is signed, allowing attackers to leverage this assertion to bypass authentication...

Xml Entity Expansion (XEE)

Zendframework is vulnerable to Denial of Service DoS through XML Entity Expansion XEE. The library calls the vulnerable methods OMDocument, SimpleXML, and xmlparse which are vulnerable to XML External Entity XXE injections and XEE...

Bypassing Authentication And Spoofing Arbitrary OpenID Identities

zendframework/zendopenid and magento/zendframework1 are vulnerable to bypassing authentication and spoofing arbitrary OpenID identities. The application fails to validate that openidopendpoint value identifies the same Identity Provider as the provider used in the association handle. This allows ...

SQL Injection

zendframework/zendframework1 is vulnerable to SQL injection. The PDO adapters do not filter null bytes from SQL statements, allowing attackers to leverage this flaw to inject and execute SQL queries...

SQL Injection

ZendFramework is vulnerable to SQL Injection. The order and group methods in library/Zend/Db/Select.php does not sanitize the user input properly, allowing a malicious user to inject and execute arbitrary SQL queries...

Cross-Site Request Forgery (CSRF)

zendframework is vulnerable to cross-site request forgery CSRF. The library does not correctly identify null or mal-formed token identifiers, causing them to be falsely identified as valid tokens. This can allow a malicious user to use this as a vector for cross-site request forgery CSRF...

Fedora 25 : php-zendframework-zend-mail (2016-a6e72e28e1)

Version 2.7.2 - 2016-12-19 - Fixes ZF2016-04. Potential remote code execution in zend-mail via Sendmail adapter Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format ...

Fedora 24 : php-zendframework-zend-mail (2016-1185de6aa6)

Version 2.7.2 - 2016-12-19 - Fixes ZF2016-04. Potential remote code execution in zend-mail via Sendmail adapter Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format ...

Fedora Update for php-zendframework-zend-mail FEDORA-2016-1185de6aa6

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for php-zendframework-zend-mail FEDORA-2016-a6e72e28e1

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...