PT-2013-1996 · Zend · Zend Framework

Pádraic Brady · Publicado 2013-02-13 · Atualizado 2022-05-17 · CVE-2012-6532

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1.x versions prior to 1.11.13 Zend Framework 1.x versions 1.12.x prior to 1.12.0

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration. This type of attack is known as an XML Entity Expansion (XEE) attack.

Recommendations For versions prior to 1.11.13, update to version 1.11.13 or later to resolve the issue. For versions 1.12.x prior to 1.12.0, update to version 1.12.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of XML DOCTYPE declarations to minimize the risk of exploitation.

Correção

DoS

XML Entity Expansion

Enumeração de Fraquezas

CWE-399

CWE-776

Identificadores relacionados

CVE-2012-6532

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-JH4X-4WMF-67PR

Produtos afetados

Zend Framework

Referências · 30

• https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db · Nota
• https://github.com/zendframework/zf1 · Nota
• https://web.archive.org/web/20131101014013/http://mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115 · Nota
• https://cve.org/CVERecord?id=CVE-2012-6532 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6532 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2013:115 · Aviso do Fabricante
• http://framework.zend.com/security/advisory/ZF2012-02 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-jh4x-4wmf-67pr · Aviso do Fabricante