CVE-2012-4451
First published: Thu Sep 27 2012(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/zendframework | ||
| Zend Zend Framework | <2.0.1 | |
| Fedoraproject Fedora | =16 | |
| Fedoraproject Fedora | =17 | |
| Redhat Enterprise Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2012-4451
- http://seclists.org/oss-sec/2012/q3/571
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946
- http://framework.zend.com/security/advisory/ZF2012-03
- http://seclists.org/oss-sec/2012/q3/573
- http://www.securityfocus.com/bid/55636
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10
- https://bugs.gentoo.org/show_bug.cgi?id=436210
- https://bugzilla.redhat.com/show_bug.cgi?id=860738
- https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
Frequently Asked Questions
What is the severity of CVE-2012-4451?
The severity of CVE-2012-4451 is rated as medium with a score of 6.1.
How do I fix CVE-2012-4451?
To fix CVE-2012-4451, upgrade to Zend Framework version 2.0.1 or later.
What are the main issues caused by CVE-2012-4451?
CVE-2012-4451 allows remote attackers to inject arbitrary web script or HTML through multiple entry points.
Which versions of Zend Framework are affected by CVE-2012-4451?
CVE-2012-4451 affects Zend Framework versions prior to 2.0.1.
What is the nature of the vulnerabilities in CVE-2012-4451?
CVE-2012-4451 involves multiple cross-site scripting (XSS) vulnerabilities.
- collector/debian-bugs
- alias/CVE-2012-4451
- collector/security-tracker-debian
- collector/nvd-index
- package-manager/debian
- vendor/zend
- product/zend framework
- canonical/zend zend framework
- vendor/fedoraproject
- product/fedora
- canonical/fedoraproject fedora
- vendor/redhat
- product/enterprise linux
- canonical/redhat enterprise linux