p PatchFirst

CVE-2015-3154

CVE-2015-3154

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

CVSS 6.1 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • zend framework

    Versions
    • before 1.12.12: Affected
    • 2.x before 2.3.8: Affected
    • 2.4.x before 2.4.1: Affected

    No fix published

  • zendframework/zend-http Packagist

    Versions
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.2.0
    • 2.2.0rc1
    • 2.2.0rc2
    • 2.2.0rc3
    • 2.2.1
    • 2.2.10
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    • 2.2.9
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0beta4, < 2.3.8

    Update to 2.3.8

  • zendframework/zend-http Packagist

    Versions
    • 2.4.0
    • 2.4.0rc1
    • 2.4.0rc2
    • 2.4.0rc3
    • 2.4.0rc4
    • 2.4.0rc5
    • 2.4.0rc6
    • 2.4.0rc7
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0rc1, < 2.4.1

    Update to 2.4.1

  • zendframework/zendframework Packagist

    Versions
    • 2.0.0
    • 2.0.0beta4
    • 2.0.0beta5
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.0rc6
    • 2.0.0rc7
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.2.0
    • 2.2.0rc1
    • 2.2.0rc2
    • 2.2.0rc3
    • 2.2.1
    • 2.2.10
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    • 2.2.9
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0beta4, < 2.3.8

    Update to 2.3.8

  • zendframework/zendframework Packagist

    Versions
    • 2.4.0
    • 2.4.0rc1
    • 2.4.0rc2
    • 2.4.0rc3
    • 2.4.0rc4
    • 2.4.0rc5
    • 2.4.0rc6
    • 2.4.0rc7
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0rc1, < 2.4.1

    Update to 2.4.1

  • zendframework/zendframework1 Packagist

    Versions
    • 1.12.0
    • 1.12.1
    • 1.12.10
    • 1.12.11
    • 1.12.2
    • 1.12.3
    • 1.12.4
    • 1.12.5
    • 1.12.6
    • 1.12.7
    • 1.12.8
    • 1.12.9
    Affected ranges
    • ECOSYSTEM: < 1.12.12

    Update to 1.12.12

  • zendframework/zend-http Packagist

    Affected ranges
    • ECOSYSTEM: < 1.12.12

    Update to 1.12.12

  • zend-framework Ubuntu:16.04:LTS

    Versions
    • 1.11.11-0ubuntu2
    • 1.11.11-0ubuntu3
    • 1.11.11-0ubuntu3.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →