Description
(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | zendframework | 1.10.6-1squeeze3 | DLA-251-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | zend-framework | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | zendframework/zendframework1 | >= 1.0, < 1.11.13 | 1.11.13 | GHSA-h5p3-7mg6-hgj4 |
| Packagist | zendframework/zendframework1 | >= 1.12.0-rc1, < 1.12.0 | 1.12.0 | GHSA-h5p3-7mg6-hgj4 |
Advisories 1
- DLA-251-1 zendframework - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20120627 Re: XXE in Zend mailing-list
- DSA-2505 vendor-advisory
- [oss-security] 20120626 Re: XXE in Zend mailing-list
- [oss-security] 20120626 XXE in Zend mailing-list
- http://framework.zend.com/security/advisory/ZF2012-01
- https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt