zendframework - security update

Fixed packages 1

Vulnerabilities 9

• Critical 9.8
  CVE-2014-8089

  Zend Framework SQL injection vulnerability

  SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

  zendframework/zendframework1 zendframework/zendframework zend-framework zendframework/zend-db Ubuntu Packagist
  Feb 17, 2020
• Medium 6.1
  CVE-2015-3154

  Zenario CMS vulnerable to CRLF injection

  CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the hea…

  Zend Zend Framework zendframework/zendframework1 zendframework/zendframework Ubuntu Packagist
  Jan 27, 2020
• Medium —
  CVE-2014-2681

  Several Zend Products Vulnerable to XXE and XEE attacks

  Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…

  zendframework/zendframework1 zendframework/zendopenid zendframework/zendservice-windowsazure zendframework/zendservice-api Packagist
  Nov 16, 2014
• Medium —
  CVE-2014-2682

  Several Zend Products Vulnerable to XXE and XEE attacks

  Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…

  zendframework/zendframework1 zendframework/zendopenid zendframework/zendservice-slideshare zendframework/zendservice-windowsazure Packagist
  Nov 16, 2014
• Medium —
  CVE-2014-2683

  Several Zend Products Vulnerable to XXE and XEE attacks

  Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, Zend…

  zendframework/zendframework1 zendframework/zendopenid zendframework/zendrest zendframework/zendservice-nirvanix Packagist
  Nov 16, 2014
• Unscored —
  CVE-2014-2684

  The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Ze…

  Nov 16, 2014
• Unscored —
  CVE-2014-2685

  The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Ze…

  Sep 4, 2014
• Unscored —
  CVE-2014-4914

  The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows r…

  Dec 29, 2017
• Medium —
  CVE-2014-8088

  Zend Access Restriction Bypass

  The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.

  zendframework/zendframework1 zendframework/zendframework zend-framework Ubuntu Packagist
  Oct 22, 2014