CVE-2011-1939 SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
CriticalCVSS 9.8
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zend framework | >= 1.10.0, < 1.10.9 | 1.10.9 |
| zend framework | >= 1.11.0, < 1.11.6 | 1.11.6 |
| PHP | < 5.3.6 | 5.3.6 |
| debian linux | = 8.0 | No fix listed |
| zendframework;PHP zendframework | = 1.10.x before 1.10.9 | No fix listed |
| zendframework;PHP zendframework | = 1.11.x before 1.11.6 | No fix listed |
| PHP | = before 5.3.6 | No fix listed |
References
- security.gentoo.org third-party-advisory
- 47919 third-party-advisory vdb-entry
- access.redhat.com broken-link
- bugs.php.net exploit third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- framework.zend.com vendor-advisory
- security-tracker.debian.org third-party-advisory