bugtraq - [SECURITY] [DSA 3340-1] zendframework security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20150819214319.5EFB5417@bendel.debian.org>
Date: Wed, 19 Aug 2015 23:43:10 +0200
From: Alessandro Ghedini <ghedo@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3340-1] zendframework security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3340-1                   security@...ian.org
https://www.debian.org/security/                       Alessandro Ghedini
August 19, 2015                       https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : zendframework
CVE ID         : CVE-2015-5161

Dawid Golunski discovered that when running under PHP-FPM in a threaded
environment, Zend Framework, a PHP framework, did not properly handle
XML data in multibyte encoding. This could be used by remote attackers
to perform an XML External Entity attack via crafted XML data.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.11.13-1.1+deb7u3.

For the stable distribution (jessie), this problem has been fixed in
version 1.12.9+dfsg-2+deb8u3.

For the testing distribution (stretch), this problem has been fixed
in version 1.12.14+dfsg-1.

For the unstable distribution (sid), this problem has been fixed in
version 1.12.14+dfsg-1.

We recommend that you upgrade your zendframework packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJV1PhuAAoJEK+lG9bN5XPLQjoP/07zcTekHwPyQi/BNw0wVwNt
WvglZIiPwd4pvBaxeUalKlJfvGpCbahLKivPzOiaDcD/dIMXLGqwHnKQRVOcPWH2
uMFnJx8XhO2bWHbaG3NzVBXc8EtV3YpWNo48BCpPGnNhywYm59hVsocZr96rti4g
0GR5Rr63tlYG3b5JMklfYLj7KBgMD77HIakZTb7Uo+5efL3N5PIveAZdpD5h/xPq
wR+84YSM3Zor4FTIYfT6IZv4LQPH76u9vpw/EMmHybQ06unx2TNKUHHn7XM344Lo
yxGq8vuAFkIl60S88T6MiiwjVmoSYElJh/fdpXMfbPJigrQDWl0wTScOuPxja5KJ
1u1JLYn/NlhIsnDk4aH5zQDmET5W11CSQD3TENGeDAgVX6eXq0Ro12G8XjBcNHvE
xewnkzJV9XtYj9dOfBShF1SZN/SxVkT1cPeZ/+w1lTMXDc9t0+nRxwqtAEAeUJ+U
c7ONekrgV48bxE+KcNRo2GTnfT9c9fsDHJdQrgo8rsUdfZHO88VzWSRTTmBLMFux
wpHwVQKs7qN0WrbXk3CdSKObXbgPfr0xQ1g3FWmcX+KENgrx9khTcRiE5mrG8+r+
fpEoupuJ7y+AR24gzZ8tyRwFpK4BJAZXh5j27lyBqoQ8quR+KER5wlNHq4y47eaI
gKvVg66bMaOScsAZg0VU
=Yn6b
-----END PGP SIGNATURE-----