From:
[email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-3340-1
[email protected] https://www.debian.org/security/ Alessandro Ghedini August 19, 2015
https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : zendframework
CVE ID : CVE-2015-5161
Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle
XML data in multibyte encoding. This could be used by remote attackers
to perform an XML External Entity attack via crafted XML data.
For the oldstable distribution (wheezy), this problem has been fixed
in version 1.11.13-1.1+deb7u3.
For the stable distribution (jessie), this problem has been fixed in
version 1.12.9+dfsg-2+deb8u3.
For the testing distribution (stretch), this problem has been fixed
in version 1.12.14+dfsg-1.
For the unstable distribution (sid), this problem has been fixed in
version 1.12.14+dfsg-1.
We recommend that you upgrade your zendframework packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:
https://www.debian.org/security/
Mailing list:
[email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV1PhuAAoJEK+lG9bN5XPLQjoP/07zcTekHwPyQi/BNw0wVwNt WvglZIiPwd4pvBaxeUalKlJfvGpCbahLKivPzOiaDcD/dIMXLGqwHnKQRVOcPWH2 uMFnJx8XhO2bWHbaG3NzVBXc8EtV3YpWNo48BCpPGnNhywYm59hVsocZr96rti4g 0GR5Rr63tlYG3b5JMklfYLj7KBgMD77HIakZTb7Uo+5efL3N5PIveAZdpD5h/xPq wR+84YSM3Zor4FTIYfT6IZv4LQPH76u9vpw/EMmHybQ06unx2TNKUHHn7XM344Lo yxGq8vuAFkIl60S88T6MiiwjVmoSYElJh/fdpXMfbPJigrQDWl0wTScOuPxja5KJ 1u1JLYn/NlhIsnDk4aH5zQDmET5W11CSQD3TENGeDAgVX6eXq0Ro12G8XjBcNHvE xewnkzJV9XtYj9dOfBShF1SZN/SxVkT1cPeZ/+w1lTMXDc9t0+nRxwqtAEAeUJ+U c7ONekrgV48bxE+KcNRo2GTnfT9c9fsDHJdQrgo8rsUdfZHO88VzWSRTTmBLMFux wpHwVQKs7qN0WrbXk3CdSKObXbgPfr0xQ1g3FWmcX+KENgrx9khTcRiE5mrG8+r+ fpEoupuJ7y+AR24gzZ8tyRwFpK4BJAZXh5j27lyBqoQ8quR+KER5wlNHq4y47eaI gKvVg66bMaOScsAZg0VU
=Yn6b
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)