MGASA-2017-0016

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2017-0016.html

Import Source

https://advisories.mageia.org/MGASA-2017-0016.json

JSON Data

https://api.osv.dev/v1/vulns/MGASA-2017-0016

Related

CVE-2016-10034

Published

2017-01-13T10:32:16Z

Modified

2017-01-13T10:20:57Z

Summary

Updated php-ZendFramework2 packages fix security vulnerability

Details

When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability (CVE-2016-10034).

References

Credits

- Mageia - COORDINATOR
- - https://wiki.mageia.org/en/Packages_Security_Team

Affected packages

Mageia:5 / php-ZendFramework2

Package

Name: php-ZendFramework2
Purl: pkg:rpm/mageia/php-ZendFramework2?arch=source&distro=mageia-5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.11-1.mga5

Ecosystem specific

{
    "section": "core"
}