PT-2015-6789 · Zend+2 · Zendxml+3

Dawid Golunski · Published 2015-08-19 · Updated 2022-05-17 · CVE-2015-5161

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZendXml versions prior to 1.0.1 Zend Framework versions prior to 1.12.14 Zend Framework 2.x versions prior to 2.4.6 Zend Framework 2.5.x versions prior to 2.5.2

Description The issue allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters when running under PHP-FPM in a threaded environment. This is due to a problem in the Zend Xml Security::scan function.

Recommendations For ZendXml version prior to 1.0.1, update to version 1.0.1 or later. For Zend Framework version prior to 1.12.14, update to version 1.12.14 or later. For Zend Framework 2.x version prior to 2.4.6, update to version 2.4.6 or later. For Zend Framework 2.5.x version prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Fix

XML Entity Expansion

XXE

Weakness Enumeration

CWE-776

CWE-611

Related Identifiers

CVE-2015-5161

DLA-302-1

DSA-3340-1

GHSA-XP8P-9RQ5-4WGV

MGASA-2015-0370

MGASA-2015-0371

SUSE-SU-2016:1638-1

Affected Products

Php-Fpm

Suse

Zend Framework

Zendxml

References · 196

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Aug/46 · Exploit
• 🔥 https://exploit-db.com/exploits/37765 · Exploit
• 🔥 http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html · Exploit
• 🔥 http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt · Exploit
• 🔥 http://securityfocus.com/bid/76177 · Exploit
• 🔥 https://exploit-db.com/exploits/38573 · Exploit
• http://debian.org/security/2015/dsa-3340 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5161 · Security Note
• https://osv.dev/vulnerability/GHSA-xp8p-9rq5-4wgv · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0371.html · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html · Vendor Advisory