From Mageia wiki
Jump to: navigation, search

MGASA-2012-0200

Date: August 6th, 2012
Affected releases: 1, 2


Description:
Updated php-ZendFramework packages fix a security vulnerability:

A file disclosure flaw was found in the way SimpleXMLElement class of
Zend Framework, a PHP framework, processed XML data provided within
certain XML-RPC requests (external XML entities were previously
possible to specify by adding a specific DOCTYPE element to particular
XML-RPC request). A remote attacker could use this flaw to obtain
sensitive information by issuing a specially-crafted XML-RPC request
to the Zend Framework based PHP application (CVE-2012-3363).


Updated Packages:
Mageia 1:
php-ZendFramework-1.11.0-1.1.mga1
php-ZendFramework-demos-1.11.0-1.1.mga1
php-ZendFramework-extras-1.11.0-1.1.mga1
php-ZendFramework-tests-1.11.0-1.1.mga1
php-ZendFramework-Cache-Backend-Apc-1.11.0-1.1.mga1
php-ZendFramework-Cache-Backend-Memcached-1.11.0-1.1.mga1
php-ZendFramework-Captcha-1.11.0-1.1.mga1
php-ZendFramework-Dojo-1.11.0-1.1.mga1
php-ZendFramework-Feed-1.11.0-1.1.mga1
php-ZendFramework-Gdata-1.11.0-1.1.mga1
php-ZendFramework-Pdf-1.11.0-1.1.mga1
php-ZendFramework-Search-Lucene-1.11.0-1.1.mga1
php-ZendFramework-Services-1.11.0-1.1.mga1

Mageia 2:
php-ZendFramework-1.11.11-1.1.mga2
php-ZendFramework-demos-1.11.11-1.1.mga2
php-ZendFramework-extras-1.11.11-1.1.mga2
php-ZendFramework-tests-1.11.11-1.1.mga2
php-ZendFramework-Captcha-1.11.11-1.1.mga2
php-ZendFramework-Cache-Backend-Apc-1.11.11-1.1.mga2
php-ZendFramework-Cache-Backend-Memcached-1.11.11-1.1.mga2
php-ZendFramework-Dojo-1.11.11-1.1.mga2
php-ZendFramework-Feed-1.11.11-1.1.mga2
php-ZendFramework-Gdata-1.11.11-1.1.mga2
php-ZendFramework-Search-Lucene-1.11.11-1.1.mga2
php-ZendFramework-Pdf-1.11.11-1.1.mga2
php-ZendFramework-Services-1.11.11-1.1.mga2


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3363
http://framework.zend.com/security/advisory/ZF2012-01
https://bugzilla.redhat.com/show_bug.cgi?id=835560
http://www.debian.org/security/2012/dsa-2505
https://bugs.mageia.org/show_bug.cgi?id=6666