PT-2015-6789

Name of the Vulnerable Software and Affected Versions ZendXml versions prior to 1.0.1 Zend Framework versions prior to 1.12.14 Zend Framework 2.x versions prior to 2.4.6 Zend Framework 2.5.x versions prior to 2.5.2 Description The issue allows remote attackers to bypass security checks and conduc...

Zend Framework 2.4.2 / 1.12.13 XXE Injection

============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY ------------------------- Zend Framework From http://framework.zend.com/about/ website:...

Zend Framework 2.4.2 / 1.12.13 XXE Injection Vulnerability

Zend Framework versions 2.4.2 and below and 1.12.13 and below suffer from an XML external entity injection vulnerability. ============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161...

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection ============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY -------------------------...

Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection

============================================= - Release date: 12.08.2015 - Discovered by: Dawid Golunski - Severity: High - CVE-ID: CVE-2015-5161 ============================================= I. VULNERABILITY ------------------------- Zend Framework = 2.4.2 XML eXternal Entity Injection XXE on PH...

Medium: php-ZendFramework

Issue Overview: Upstream reported http://framework.zend.com/security/advisory/ZF2015-04 a vulnerability in the Zend\Mail component in Zend Framework 2, specifically in how it handles headers. Headers are not correctly filtered for newlines, allowing the ability to send additional, unrelated heade...

Fedora 21 : php-ZendFramework-1.12.13-1.fc21 (2015-8710)

Zend Framework 1.12.13 - 567: Cast int and float to string when creating headers Zend Framework 1.12.12 - 493: PHPUnit not being installed - 511: Add PATCH to the list of allowed methods in ZendControllerRequestHttpTestCase - 513: Save time and space when cloning PHPUnit - 515: !IE conditional...

Fedora 20 : php-ZendFramework-1.12.13-1.fc20 (2015-8714)

Zend Framework 1.12.13 - 567: Cast int and float to string when creating headers Zend Framework 1.12.12 - 493: PHPUnit not being installed - 511: Add PATCH to the list of allowed methods in ZendControllerRequestHttpTestCase - 513: Save time and space when cloning PHPUnit - 515: !IE conditional...

Fedora 22 : php-ZendFramework-1.12.13-1.fc22 (2015-8704)

Zend Framework 1.12.13 - 567: Cast int and float to string when creating headers Zend Framework 1.12.12 - 493: PHPUnit not being installed - 511: Add PATCH to the list of allowed methods in ZendControllerRequestHttpTestCase - 513: Save time and space when cloning PHPUnit - 515: !IE conditional...

[SECURITY] Fedora 21 Update: php-ZendFramework-1.12.13-1.fc21

Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...

[SECURITY] Fedora 20 Update: php-ZendFramework-1.12.13-1.fc20

Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...

[SECURITY] Fedora 22 Update: php-ZendFramework-1.12.13-1.fc22

Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...

[SECURITY] Fedora 22 Update: php-ZendFramework2-2.3.8-1.fc22

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

DSA-3265-2 zendframework - regression update

Bulletin has no description...

PT-2020-7833

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.12.12 Zend Framework 2.x versions prior to 2.3.8 Zend Framework 2.4.x versions prior to 2.4.1 Description: A CRLF injection vulnerability in ZendMail Zend Mail allows remote attackers to inject arbitrary HTT...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

[SECURITY] Fedora 21 Update: php-ZendFramework2-2.3.8-1.fc21

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

[SECURITY] Fedora 20 Update: php-ZendFramework2-2.3.8-1.fc20

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

Zend Framework HTTP Response Separation Vulnerability

Zend Framework ZF is an open source PHP5 development framework for developing web programs and services. An HTTP response separation vulnerability exists in Zend Framework due to the program failing to properly filter certain inputs. This allows an attacker to insert arbitrary HTTP headers and...

Zend Zend\Mail / Zend\Http Component HTTP Response Splitting Vulnerability

Zend Framework is an open source framework for developing web programs and services with PHP. A security vulnerability in Zend Framework, which is used by the Zend Zend\Mail / Zend\Http component, could be exploited by remote attackers to conduct HTTP response splitting attacks...