MediumGHSA-xp8p-9rq5-4wgvCVE-2015-5161
ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
Published 17 May 2022 · Updated 4 Dec 2024
Affected packages
zendframework/zendframeworkComposer
- Affected
- >=2.0.0 <2.4.6
- Fixed in
- 2.4.6
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework:^2.4.6zendframework/zendframeworkComposer
- Affected
- >=2.5.0 <2.5.2
- Fixed in
- 2.5.2
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework:^2.5.2zendframework/zendframework1Composer
- Affected
- >=1.12.0 <1.12.14
- Fixed in
- 1.12.14
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.12.14zendframework/zendxmlComposer
- Affected
- >=1.0.0 <1.0.1
- Fixed in
- 1.0.1
Update to the fixed version for your release line, for example:
composer require zendframework/zendxml:^1.0.1zendframework/zendframeworkComposer
- Affected
- >=1.12.0 <1.12.14
- Fixed in
- 1.12.14
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework:^1.12.14Details
The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
Is GHSA-xp8p-9rq5-4wgv in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected zendframework/zendframework, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2015-5161
- Linkgithub.com/zendframework/zf1/issues/393
- Linkgithub.com/zendframework/ZendXml/commit/79f478fa2af85ce1fc18ac132dee5aa714c3b532
- Linkgithub.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b
- Linkframework.zend.com/security/advisory/ZF2015-06
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml
- Linkweb.archive.org/web/20200228055156/http://www.securityfocus.com/bid/76177
- Linkwww.exploit-db.com/exploits/37765
- Linkframework.zend.com/security/advisory/ZF2015-06
- Linklegalhackers.com/advisories/zend-framework-XXE-vuln.txt
- Linklists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html
- Linklists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html
- Linklists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html
- Linkpacketstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html
- Linkseclists.org/fulldisclosure/2015/Aug/46
- Linkwww.debian.org/security/2015/dsa-3340
- Linkwww.securityfocus.com/bid/76177
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.