GitHub Advisoryadvisory · Packagist

GHSA-jh4x-4wmf-67pr Zend Framework XEE Vulnerability

MEDIUM Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-6532
Ecosystem
Packagist
Packages
zendframework/zendframework1
Severity
Moderate
Weaknesses
CWE-776
Reviewed
2024-01-12

Affected packages

• Packagist zendframework/zendframework1: >= 1.0, < 1.11.13 → fixed in 1.11.13 • Packagist zendframework/zendframework1: >= 1.12.0-rc1, < 1.12.0 → fixed in 1.12.0

Description

(1) `Zend_Dom`, (2) `Zend_Feed`, (3) `Zend_Soap`, and (4) `Zend_XmlRpc` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.

Related

Alias · CVE (1)

  • CVE-2012-6532 (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote… vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References