Information Disclosure

Zendframework and zend-crypt are vulnerable to information disclosure attacks. The library uses the default php $padding which is vulnerable to Bleichenbacher's chosen-ciphertext attack that can be used to decrypt arbitrary ciphertext...

CVE-2015-7503

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...