Skip to content
OpenAdvisories
Critical DLA-1403-1 1 CVE

zendframework - security update

Published Jun 28, 2018 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 zendframework 1.12.9+dfsg-2+deb8u7

Vulnerabilities 1

  • Critical 9.8
    CVE-2016-4861 Public exploit

    Zend Framework Allows SQL Injection

    The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

    zendframework/zendframework zend-framework Ubuntu Packagist