p PatchFirst

PatchFirst · Latest vulnerabilities

zendframework/zendframework1 1.12.10: known vulnerabilities

Known vulnerabilities affecting zendframework/zendframework1 1.12.10: 9. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 9

  1. GHSA-6fqw-j3vm-7f66

    Critical · CVSS 9.8Fix available

    Zendframework1 Potential SQL injection in ORDER and GROUP functions

    The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur. The implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection: ``` $db = Zend_Db::factory(/* options here */); $select = new Zend_Db_Select($db); $select->from('p'); $select->order("MD5(\"a(\");DELETE FROM p2; #)"); // same with group() ``` The above $select will render th

    zendframework/zendframework1PHP
    • Update to 1.12.20
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-848f-mph5-9pm9

    High · CVSS 7.5Fix available

    Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability

    In Zend Framework, Zend_Captcha_Word (v1) and Zend\Captcha\Word (v2) generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.

    zendframework/zendframework1PHP
    • Update to 1.12.17
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-8xhv-gqm4-3w99

    High · CVSS 7.5Fix available

    ZendFramework1 Potential Insufficient Entropy Vulnerability

    We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls: ``` Zend_Ldap_Attribute::createPassword Zend_Form_Element_Hash::_generateHash Zend_Gdata_HttpClient::filterHttpRequest Zend_Filter_Encrypt_Mcrypt::_srand Zend_OpenId::randomBytes ``` In each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation. Moreover, we discovered a potential

    zendframework/zendframework1PHP
    • Update to 1.12.18
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. GHSA-v42g-7q2x-cw32

    Critical · CVSS 9.8Fix available

    Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)

    The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection. We tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.

    zendframework/zendframework1PHP
    • Update to 1.12.16
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2015-3154

    Medium · CVSS 6.1EPSS 1.01%Fix available

    CVE-2015-3154

    CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

    zendframework/zendframework1PHP
    • Update to 1.12.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2015-5723

    High · CVSS 7.8EPSS 0.38%Fix available

    CVE-2015-5723

    Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

    zendframework/zendframework1PHP
    • Update to 1.12.16
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2015-5161

    Not ratedEPSS 9.87%Public exploitFix available

    CVE-2015-5161

    The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

    zendframework/zendframework1PHP
    • Update to 1.12.14
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →