CVE-2015-7695
CVE-2015-7695
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
CVSS 9.8 · Critical · EPSS 2.9% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
zendframework/zendframework1 Packagist
- Versions
- 1.12.0
- 1.12.1
- 1.12.10
- 1.12.11
- 1.12.12
- 1.12.13
- 1.12.14
- 1.12.15
- 1.12.2
- 1.12.3
- 1.12.4
- 1.12.5
- 1.12.6
- 1.12.7
- 1.12.8
- 1.12.9
- Affected ranges
- ECOSYSTEM: < 1.12.16
Update to 1.12.16
zend-framework Ubuntu:16.04:LTS
- Versions
- 1.11.11-0ubuntu2
- 1.11.11-0ubuntu3
- 1.11.11-0ubuntu3.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://www.openwall.com/lists/oss-security/2015/09/30/8
- http://www.debian.org/security/2015/dsa-3369
- http://www.openwall.com/lists/oss-security/2015/10/11/3
- http://www.openwall.com/lists/oss-security/2015/09/30/6
- http://www.securityfocus.com/bid/76784
- http://framework.zend.com/security/advisory/ZF2015-08
- https://nvd.nist.gov/vuln/detail/CVE-2015-7695