Description
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | zendframework/zendframework | < 1.12.19 | 1.12.19 | GHSA-p9hp-3gpv-52w3 |
| Packagist | zendframework/zendframework1 | < 1.12.19 | 1.12.19 | GHSA-p9hp-3gpv-52w3 |
References
- FEDORA-2016-666d95d1d5 vendor-advisory
- GLSA-201804-10 vendor-advisory
- FEDORA-2016-7f193a0c59 vendor-advisory
- FEDORA-2016-77e5105570 vendor-advisory
- https://framework.zend.com/security/advisory/ZF2016-02
- 91802 vdb-entry