blob: 82a63f391ddb8f402ca8d77b1b5a26c63aa9fa08 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
<define-tag description>LTS security update</define-tag>
<define-tag moreinfo>
<p>The previous zendframework upload incorrectly fixes <a href="https://security-tracker.debian.org/tracker/CVE-2015-3154">CVE-2015-3154</a>,
causing a regression. This update corrects this problem. Thanks to
Евгений Смолин (Evgeny Smolin).</p>
<ul>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2012-6531">CVE-2012-6531</a>
<p>Pádraic Brady identified a weakness to handle the SimpleXMLElement
zendframework class, allowing to remote attackers to read arbitrary
files or create TCP connections via an XML external entity (XXE)
injection attack.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2012-6532">CVE-2012-6532</a>
<p>Pádraic Brady found that remote attackers could cause a denial of
service by CPU consumption, via recursive or circular references
through an XML entity expansion (XEE) attack.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-2681">CVE-2014-2681</a>
<p>Lukas Reschke reported a lack of protection against XML External
Entity injection attacks in some functions. This fix extends the
incomplete one from <a href="https://security-tracker.debian.org/tracker/CVE-2012-5657">CVE-2012-5657</a>.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-2682">CVE-2014-2682</a>
<p>Lukas Reschke reported a failure to consider that the
libxml_disable_entity_loader setting is shared among threads in the
PHP-FPM case. This fix extends the incomplete one from
<a href="https://security-tracker.debian.org/tracker/CVE-2012-5657">CVE-2012-5657</a>.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-2683">CVE-2014-2683</a>
<p>Lukas Reschke reported a lack of protection against XML Entity
Expansion attacks in some functions. This fix extends the incomplete
one from <a href="https://security-tracker.debian.org/tracker/CVE-2012-6532">CVE-2012-6532</a>.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-2684">CVE-2014-2684</a>
<p>Christian Mainka and Vladislav Mladenov from the Ruhr-University
Bochum reported an error in the consumer's verify method that lead
to acceptance of wrongly sourced tokens.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-2685">CVE-2014-2685</a>
<p>Christian Mainka and Vladislav Mladenov from the Ruhr-University
Bochum reported a specification violation in which signing of a
single parameter is incorrectly considered sufficient.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-4914">CVE-2014-4914</a>
<p>Cassiano Dal Pizzol discovered that the implementation of the ORDER
BY SQL statement in Zend_Db_Select contains a potential SQL
injection when the query string passed contains parentheses.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-8088">CVE-2014-8088</a>
<p>Yury Dyachenko at Positive Research Center identified potential XML
eXternal Entity injection vectors due to insecure usage of PHP's DOM
extension.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2014-8089">CVE-2014-8089</a>
<p>Jonas Sandström discovered an SQL injection vector when manually
quoting value for sqlsrv extension, using null byte.</p></li>
<li><a href="https://security-tracker.debian.org/tracker/CVE-2015-3154">CVE-2015-3154</a>
<p>Filippo Tessarotto and Maks3w reported potential CRLF injection
attacks in mail and HTTP headers.</p></li>
</ul>
</define-tag>
# do not modify the following line
#include "$(ENGLISHDIR)/lts/security/2015/dla-251.data"
# $Id$
|
