Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

zendframework/zendxml

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    ZendXml and Zend Framework contain XXE and XEE Vulnerabilities

    CVE-2015-5161 · GHSA-xp8p-9rq5-4wgv

    Affected
    • Packagist zendframework/zendxml >= 1.0.0, < 1.0.1
    Fixed in
    1.0.1· Vendor fix available
    Issue
    The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →