CVE-2012-6531
Publication date 13 February 2013
Last updated 24 July 2024
Ubuntu priority
(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
Status
Package | Ubuntu Release | Status |
---|---|---|
zend-framework | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Vulnerable
|
|
14.04 LTS trusty | Not in release | |
zendframework | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
References
Other references
- https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
- http://www.openwall.com/lists/oss-security/2012/06/27/2
- http://www.openwall.com/lists/oss-security/2012/06/26/4
- http://www.openwall.com/lists/oss-security/2012/06/26/2
- http://www.debian.org/security/2012/dsa-2505
- http://framework.zend.com/security/advisory/ZF2012-01
- https://www.cve.org/CVERecord?id=CVE-2012-6531