GHSA-xp8p-9rq5-4wgv ZendXml and Zend Framework contain XXE and XEE Vulnerabilities

• Packagist zendframework/zendframework: >= 2.0.0, < 2.4.6 → fixed in 2.4.6 • Packagist zendframework/zendframework: >= 2.5.0, < 2.5.2 → fixed in 2.5.2 • Packagist zendframework/zendframework1: >= 1.12.0, < 1.12.14 → fixed in 1.12.14 • Packagist zendframework/zendxml: >= 1.0.0, < 1.0.1 → fixed in 1.0.1 • Packagist zendframework/zendframework: >= 1.12.0, < 1.12.14 → fixed in 1.12.14

The `Zend_Xml_Security::scan` in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.