Packagist/zendframework/zendframework1 CVE-2014-2682: medium, EPSS 2.18%

Several Zend Products Vulnerable to XXE and XEE attacks

Action: Upgrade zendframework/zendframework1 to 1.12.4 or later.

composer require zendframework/zendframework1:1.12.4

Affected

Fixed versions

Sources

• osv: GHSA-gp39-h9c2-qw79
• https://nvd.nist.gov/vuln/detail/CVE-2014-2682
• https://web.archive.org/web/20140419041226/http://www.securityfocus.com/bid/66358
• https://web.archive.org/web/20150523055201/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:072/?name=MDVSA-2014:072
• http://advisories.mageia.org/MGASA-2014-0151.html
• http://framework.zend.com/security/advisory/ZF2014-01
• http://seclists.org/oss-sec/2014/q2/0
• http://www.debian.org/security/2015/dsa-3265

CVE-2014-2682 · published 2022-05-14T00:56:24Z · modified 2024-12-07T05:42:49.016631Z · JSON