CVE-2012-6532 Zend Framework XEE Vulnerability
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zendframework1(Packagist) | >= 1.0, < 1.11.13 | 1.11.13 |
| zendframework/zendframework1(Packagist) | >= 1.12.0-rc1, < 1.12.0 | 1.12.0 |
| zend framework | = 1.0.4 | No fix listed |
| zend framework | = 1.5.0 | No fix listed |
| zend framework | = 1.5.1 | No fix listed |
| zend framework | = 1.5.2 | No fix listed |
| zend framework | = 1.5.3 | No fix listed |
| zend framework | = 1.6.0 | No fix listed |
| zend framework | = 1.6.1 | No fix listed |
| zend framework | = 1.6.2 | No fix listed |
| zend framework | = 1.7.0 | No fix listed |
| zend framework | = 1.7.1 | No fix listed |
| zend framework | = 1.7.2 | No fix listed |
| zend framework | = 1.7.3 | No fix listed |
| zend framework | = 1.7.4 | No fix listed |
| zend framework | = 1.7.5 | No fix listed |
| zend framework | = 1.7.6 | No fix listed |
| zend framework | = 1.7.7 | No fix listed |
| zend framework | = 1.7.8 | No fix listed |
| zend framework | = 1.7.9 | No fix listed |
| zend framework | = 1.8.0 | No fix listed |
| zend framework | = 1.8.1 | No fix listed |
| zend framework | = 1.8.2 | No fix listed |
| zend framework | = 1.8.3 | No fix listed |
| zend framework | = 1.8.4 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| zend framework | = 1.8.5 | No fix listed |
| zend framework | = 1.9.0 | No fix listed |
| zend framework | = 1.9.1 | No fix listed |
| zend framework | = 1.9.2 | No fix listed |
| zend framework | = 1.9.3 | No fix listed |
| zend framework | = 1.9.4 | No fix listed |
| zend framework | = 1.9.5 | No fix listed |
| zend framework | = 1.9.6 | No fix listed |
| zend framework | = 1.9.7 | No fix listed |
| zend framework | = 1.9.8 | No fix listed |
| zend framework | = 1.10.0 | No fix listed |
| zend framework | = 1.10.1 | No fix listed |
| zend framework | = 1.10.2 | No fix listed |
| zend framework | = 1.10.3 | No fix listed |
| zend framework | = 1.10.4 | No fix listed |
| zend framework | = 1.10.5 | No fix listed |
| zend framework | = 1.10.6 | No fix listed |
| zend framework | = 1.10.7 | No fix listed |
| zend framework | = 1.10.8 | No fix listed |
| zend framework | = 1.11.0 | No fix listed |
| zend framework | = 1.11.1 | No fix listed |
| zend framework | = 1.11.2 | No fix listed |
| zend framework | = 1.11.3 | No fix listed |
| zend framework | = 1.11.4 | No fix listed |
| zend framework | = 1.11.5 | No fix listed |
| zend framework | = 1.11.6 | No fix listed |
| zend framework | = 1.11.7 | No fix listed |
| zend framework | = 1.11.8 | No fix listed |
| zend framework | = 1.11.9 | No fix listed |
| zend framework | = 1.11.10 | No fix listed |
| zend framework | = 1.11.11 | No fix listed |
| zend framework | = 1.11.12 | No fix listed |
| zend framework | = 1.12.0-rc1 | No fix listed |
| zend framework | = 1.12.0-rc2 | No fix listed |
| zend framework | = 1.12.0-rc3 | No fix listed |
| zend framework | = 1.12.0-rc4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- web.archive.org
- framework.zend.com vendor-advisory
- github.com
- MDVSA-2013:115 vendor-advisory