GHSA-xp8p-9rq5-4wgv
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xp8p-9rq5-4wgv
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xp8p-9rq5-4wgv/GHSA-xp8p-9rq5-4wgv.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xp8p-9rq5-4wgv
- Aliases
-
- CVE-2015-5161
- Published
- 2022-05-17T03:16:37Z
- Modified
- 2024-12-04T05:40:31.935654Z
- Summary
- ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
- Details
-
The
Zend_Xml_Security::scanin ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters. - Database specific
{ "nvd_published_at": "2015-08-25T17:59:00Z", "cwe_ids": [ "CWE-611", "CWE-776" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-08-03T21:53:46Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2015-5161
- https://github.com/zendframework/zf1/issues/393
- https://github.com/zendframework/ZendXml/commit/79f478fa2af85ce1fc18ac132dee5aa714c3b532
- https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b
- https://framework.zend.com/security/advisory/ZF2015-06
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml
- https://web.archive.org/web/20200228055156/http://www.securityfocus.com/bid/76177
- https://www.exploit-db.com/exploits/37765
- http://framework.zend.com/security/advisory/ZF2015-06
- http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html
- http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html
- http://seclists.org/fulldisclosure/2015/Aug/46
- http://www.debian.org/security/2015/dsa-3340
- http://www.securityfocus.com/bid/76177
Affected packages
Packagist / zendframework/zendframework
Package
- Name
- zendframework/zendframework
- Purl
- pkg:composer/zendframework/zendframework
Affected versions
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.0rc4
2.4.0rc5
2.4.0rc6
2.4.0rc7
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
Packagist / zendframework/zendframework
Package
- Name
- zendframework/zendframework
- Purl
- pkg:composer/zendframework/zendframework
Packagist / zendframework/zendframework1
Package
- Name
- zendframework/zendframework1
- Purl
- pkg:composer/zendframework/zendframework1
Packagist / zendframework/zendxml
Package
- Name
- zendframework/zendxml
- Purl
- pkg:composer/zendframework/zendxml
Packagist / zendframework/zendframework
Package
- Name
- zendframework/zendframework
- Purl
- pkg:composer/zendframework/zendframework