[SECURITY] [DSA 3340-1] zendframework security update

Fabricante: Debian
Fecha: 19/08/2015
Identificador: DSA 3340-1
[SECURITY] [DSA 3340-1] zendframework security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3340-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini August 19, 2015 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : zendframework CVE ID : CVE-2015-5161 Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data. For the oldstable distribution (wheezy), this problem has been fixed in version 1.11.13-1.1+deb7u3. For the stable distribution (jessie), this problem has been fixed in version 1.12.9+dfsg-2+deb8u3. For the testing distribution (stretch), this problem has been fixed in version 1.12.14+dfsg-1. For the unstable distribution (sid), this problem has been fixed in version 1.12.14+dfsg-1. We recommend that you upgrade your zendframework packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJV1PhuAAoJEK+lG9bN5XPLQjoP/07zcTekHwPyQi/BNw0wVwNt WvglZIiPwd4pvBaxeUalKlJfvGpCbahLKivPzOiaDcD/dIMXLGqwHnKQRVOcPWH2 uMFnJx8XhO2bWHbaG3NzVBXc8EtV3YpWNo48BCpPGnNhywYm59hVsocZr96rti4g 0GR5Rr63tlYG3b5JMklfYLj7KBgMD77HIakZTb7Uo+5efL3N5PIveAZdpD5h/xPq wR+84YSM3Zor4FTIYfT6IZv4LQPH76u9vpw/EMmHybQ06unx2TNKUHHn7XM344Lo yxGq8vuAFkIl60S88T6MiiwjVmoSYElJh/fdpXMfbPJigrQDWl0wTScOuPxja5KJ 1u1JLYn/NlhIsnDk4aH5zQDmET5W11CSQD3TENGeDAgVX6eXq0Ro12G8XjBcNHvE xewnkzJV9XtYj9dOfBShF1SZN/SxVkT1cPeZ/+w1lTMXDc9t0+nRxwqtAEAeUJ+U c7ONekrgV48bxE+KcNRo2GTnfT9c9fsDHJdQrgo8rsUdfZHO88VzWSRTTmBLMFux wpHwVQKs7qN0WrbXk3CdSKObXbgPfr0xQ1g3FWmcX+KENgrx9khTcRiE5mrG8+r+ fpEoupuJ7y+AR24gzZ8tyRwFpK4BJAZXh5j27lyBqoQ8quR+KER5wlNHq4y47eaI gKvVg66bMaOScsAZg0VU =Yn6b -----END PGP SIGNATURE-----