Univention Bugzilla – Bug 38572
zendframework: Multiple issues (3.2)
Last modified: 2019-04-11 19:24:41 CEST
+++ This bug was initially created as a clone of Bug #37002 +++ Denial of service through XEE (CVE-2014-2681, CVE-2014-2682, CVE-2014-2683) Incorrect validation of OpenID identity providers (CVE-2014-2684, CVE-2014-2685) SQL injection in Zend_Db_Select (CVE-2014-4914) Incorrect NULL byte handling in LDAP authentication (CVE-2014-8088) SQL injection in sqlsrv extension (CVE-2014-8089) Potential CRLF injection attacks in mail and HTTP headers (CVE-2015-3154)
Upstream Debian package version 1.10.6-1squeeze3 fixes all issues above plus * CVE-2012-6531 Pádraic Brady identified a weakness to handle the SimpleXMLElement zendframework class, allowing to remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack. * CVE-2012-6532 Pádraic Brady found that remote attackers could cause a denial of service by CPU consumption, via recursive or circular references through an XML entity expansion (XEE) attack.
Additionally, upstream Debian package version 1.11.13-1.1+deb7u3 fixes: * The Zend_Xml_Security::scan in Zend Framework before 1.12.14, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters (CVE-2015-5161) Additionally, upstream Debian package version 1.11.13-1.1+deb7u4 fixes: * It was discovered that due to incorrect permissions masks when creating directories, local attackers could potentially execute arbitrary code or escalate privileges (CVE-2015-5723) * SQL injection vector caused by missing null byte filtering in the MS SQL PDO backend, a similar issue was also found in the SQLite backend (ZF2015-08) (no CVE assigned)
Ignore Comment 2, that was intended for UCS 4.0. zendframework in UCS 3.2 [squeeze] is not-affected by CVE-2015-5723 Upstream Debian package version 1.10.6-1squeeze5 fixes this issue: * When running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data (CVE-2015-5161)
Upstream Debian package version 1.10.6-1squeeze6 fixes this issue: ZF2015-08: Potential SQL injection vector using null byte for PDO (MsSql, SQLite) (CVE-2015-7695)
This issue has been filed against UCS 3. UCS 3 is out of the normal maintenance and many UCS components have vastly changed in UCS 4. If this issue is still valid, please change the version to a newer UCS version otherwise this issue will be automatically closed in the next weeks.
This issue has been filed against UCS 3.2. UCS 3.2 is out of maintenance and many UCS components have vastly changed in later releases. Thus, this issue is now being closed. If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen this issue. In this case please provide detailed information on how this issue is affecting you.