| Name | CVE-2014-2682 |
| Description | Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-251-1, DSA-3265-1 |
| Debian Bugs | 743175 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| zendframework (PTS) | jessie, jessie (lts) | 1.12.9+dfsg-2+deb8u7 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| zendframework | source | squeeze | 1.10.6-1squeeze3 | DLA-251-1 | ||
| zendframework | source | wheezy | 1.11.13-1.1+deb7u1 | DSA-3265-1 | ||
| zendframework | source | (unstable) | 1.12.5-0.1 | 743175 |
http://framework.zend.com/security/advisory/ZF2014-01