Описание
The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.0.1-1 |
| esm-infra-legacy/trusty | DNE | |
| precise | DNE | |
| trusty | DNE | |
| trusty/esm | DNE | |
| upstream | needs-triage | |
| vivid | ignored | end of life |
| vivid/stable-phone-overlay | DNE | |
| vivid/ubuntu-core | DNE | |
| wily | DNE |
Показывать по
EPSS
6.8 Medium
CVSS2
Связанные уязвимости
The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework ...
ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
EPSS
6.8 Medium
CVSS2