Update to 1.12.16 - fixes CVE-2015-5161:
http://framework.zend.com/security/advisory/ZF2015-06 - fixes CVE-2015-5723: http://framework.zend.com/security/advisory/ZF2015-07 - removed services: DeveloperGarden, Technorati

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Zend Framework Upstream ChangeLogs: * [Version 2.4.7](http://framework.zend.com/changelog/2.4.7/) * [Version 2.4.6](http://framework.zend.com/changelog/2.4.6/) * [Version 2.4.5](http://framework.zend.com/changelog/2.4.5/) * [Version 2.4.4](http://framework.zend.com/changelog/2.4.4/) * [Version 2.4.3](http://framework.zend.com/changelog/2.4.3/) * [Version 2.4.2](http://framework.zend.com/changelog/2.4.2/) * [Version 2.4.1](http://framework.zend.com/changelog/2.4.1/) * [Version 2.4.0](http://framework.zend.com/changelog/2.4.0/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Zend Framework Upstream ChangeLog: * [Version 2.4.7](http://framework.zend.com/changelog/2.4.7/) * [Version 2.4.6](http://framework.zend.com/changelog/2.4.6/) * [Version 2.4.5](http://framework.zend.com/changelog/2.4.5/) * [Version 2.4.4](http://framework.zend.com/changelog/2.4.4/) * [Version 2.4.3](http://framework.zend.com/changelog/2.4.3/) * [Version 2.4.2](http://framework.zend.com/changelog/2.4.2/) * [Version 2.4.1](http://framework.zend.com/changelog/2.4.1/) * [Version 2.4.0](http://framework.zend.com/changelog/2.4.0/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data.

For Debian 6 'Squeeze', this issue has been fixed in zendframework version 1.10.6-1squeeze5.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data.

Versions of Zend Framework 1.x earlier than 1.12.14, 2.x earlier than 2.4.6, or 2.5.x earlier than 2.5.28 are vulnerable to an XXE (Xml eXternal Entity) injection flaw in ZendMXL that is triggered during the parsing of multibyte XML data.  The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source.  By sending specially crafted XML data, a remote attacker can gain unauthorized access to information or cause a denial of service.

ID	Name	Product	Family	Published	Updated	Severity
89458	Fedora 21 : php-ZendFramework-1.12.16-1.fc21 (2015-f1e18131bc)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
85669	Fedora 21 : php-ZendFramework2-2.4.7-1.fc21 / php-guzzle-Guzzle-3.9.3-5.fc21 (2015-13488)	Nessus	Fedora Local Security Checks	8/28/2015	1/11/2021	medium
89271	Fedora 22 : php-ZendFramework-1.12.16-1.fc22 (2015-6d70a701bf)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
85670	Fedora 22 : php-ZendFramework2-2.4.7-1.fc22 / php-guzzle-Guzzle-3.9.3-5.fc22 (2015-13529)	Nessus	Fedora Local Security Checks	8/28/2015	1/11/2021	medium
85591	Fedora 23 : php-ZendFramework2-2.4.7-1.fc23 / php-guzzle-Guzzle-3.9.3-5.fc23 (2015-13314)	Nessus	Fedora Local Security Checks	8/24/2015	1/11/2021	medium
85663	Debian DLA-302-1 : zendframework security update	Nessus	Debian Local Security Checks	8/28/2015	1/11/2021	medium
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	8/29/2016	1/19/2021	critical
85589	Debian DSA-3340-1 : zendframework - security update	Nessus	Debian Local Security Checks	8/24/2015	1/11/2021	medium
89193	Fedora 23 : php-ZendFramework-1.12.16-1.fc23 (2015-2e7c06c639)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
9136	Zend Framework 1.x < 1.12.14 / 2.x < 2.4.6 / 2.5.x < 2.5.2 XXE Injection	Nessus Network Monitor	CGI	3/15/2016	3/6/2019	high

Detections

Analytics

Plugins Search

high

medium

high

medium

medium

medium

critical

medium

high

high