The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6,
    and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to
    bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via
    multibyte encoded characters. (CVE-2015-5161)

Versions of Zend Framework 1.x earlier than 1.12.14, 2.x earlier than 2.4.6, or 2.5.x earlier than 2.5.28 are vulnerable to an XXE (Xml eXternal Entity) injection flaw in ZendMXL that is triggered during the parsing of multibyte XML data.  The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source.  By sending specially crafted XML data, a remote attacker can gain unauthorized access to information or cause a denial of service.

Update to 1.12.16 - fixes CVE-2015-5161:
http://framework.zend.com/security/advisory/ZF2015-06 - fixes CVE-2015-5723: http://framework.zend.com/security/advisory/ZF2015-07 - removed services: DeveloperGarden, Technorati

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Zend Framework Upstream ChangeLogs: * [Version 2.4.7](http://framework.zend.com/changelog/2.4.7/) * [Version 2.4.6](http://framework.zend.com/changelog/2.4.6/) * [Version 2.4.5](http://framework.zend.com/changelog/2.4.5/) * [Version 2.4.4](http://framework.zend.com/changelog/2.4.4/) * [Version 2.4.3](http://framework.zend.com/changelog/2.4.3/) * [Version 2.4.2](http://framework.zend.com/changelog/2.4.2/) * [Version 2.4.1](http://framework.zend.com/changelog/2.4.1/) * [Version 2.4.0](http://framework.zend.com/changelog/2.4.0/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data.

For Debian 6 'Squeeze', this issue has been fixed in zendframework version 1.10.6-1squeeze5.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Zend Framework Upstream ChangeLog: * [Version 2.4.7](http://framework.zend.com/changelog/2.4.7/) * [Version 2.4.6](http://framework.zend.com/changelog/2.4.6/) * [Version 2.4.5](http://framework.zend.com/changelog/2.4.5/) * [Version 2.4.4](http://framework.zend.com/changelog/2.4.4/) * [Version 2.4.3](http://framework.zend.com/changelog/2.4.3/) * [Version 2.4.2](http://framework.zend.com/changelog/2.4.2/) * [Version 2.4.1](http://framework.zend.com/changelog/2.4.1/) * [Version 2.4.0](http://framework.zend.com/changelog/2.4.0/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data.

ID	Name	Product	Family	Severity
434847	SCA: security update for zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml (GHSA-xp8p-9rq5-4wgv)	Tenable Cloud Security	SCA Checks	medium
434847	SCA: security update for zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml (GHSA-xp8p-9rq5-4wgv)	Tenable Self-Hosted Container Security	SCA Checks	medium
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	critical
9136	Zend Framework 1.x < 1.12.14 / 2.x < 2.4.6 / 2.5.x < 2.5.2 XXE Injection	Nessus Network Monitor	CGI	high
89458	Fedora 21 : php-ZendFramework-1.12.16-1.fc21 (2015-f1e18131bc)	Nessus	Fedora Local Security Checks	high
89271	Fedora 22 : php-ZendFramework-1.12.16-1.fc22 (2015-6d70a701bf)	Nessus	Fedora Local Security Checks	high
89193	Fedora 23 : php-ZendFramework-1.12.16-1.fc23 (2015-2e7c06c639)	Nessus	Fedora Local Security Checks	high
85670	Fedora 22 : php-ZendFramework2-2.4.7-1.fc22 / php-guzzle-Guzzle-3.9.3-5.fc22 (2015-13529)	Nessus	Fedora Local Security Checks	medium
85669	Fedora 21 : php-ZendFramework2-2.4.7-1.fc21 / php-guzzle-Guzzle-3.9.3-5.fc21 (2015-13488)	Nessus	Fedora Local Security Checks	medium
85663	Debian DLA-302-1 : zendframework security update	Nessus	Debian Local Security Checks	medium
85591	Fedora 23 : php-ZendFramework2-2.4.7-1.fc23 / php-guzzle-Guzzle-3.9.3-5.fc23 (2015-13314)	Nessus	Fedora Local Security Checks	medium
85589	Debian DSA-3340-1 : zendframework - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-5161

medium

Tenable Plugins

medium

medium

critical

high

high

high

high

medium

medium

medium

medium

medium