PT-2013-1996 · Zend · Zend Framework

Pádraic Brady · Published 2013-02-13 · Updated 2022-05-17 · CVE-2012-6532

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1.x versions prior to 1.11.13 Zend Framework 1.x versions 1.12.x prior to 1.12.0

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration. This type of attack is known as an XML Entity Expansion (XEE) attack.

Recommendations For versions prior to 1.11.13, update to version 1.11.13 or later to resolve the issue. For versions 1.12.x prior to 1.12.0, update to version 1.12.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of XML DOCTYPE declarations to minimize the risk of exploitation.

Fix

DoS

XML Entity Expansion

Weakness Enumeration

CWE-399

CWE-776

Related Identifiers

CVE-2012-6532

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-JH4X-4WMF-67PR

Affected Products

Zend Framework

References · 30

• https://cve.org/CVERecord?id=CVE-2012-6532 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6532 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:115 · Vendor Advisory
• http://framework.zend.com/security/advisory/ZF2012-02 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Security Note
• https://osv.dev/vulnerability/GHSA-jh4x-4wmf-67pr · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6532 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683 · Security Note