CVE-2012-5657: Infoleak
The (1) ZendFeedRss and (2) ZendFeedAtom classes in ZendFeed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5657?
CVE-2012-5657 is classified with a high severity level as it allows remote attackers to read arbitrary files and potentially cause denial of service.
How do I fix CVE-2012-5657?
To fix CVE-2012-5657, upgrade to Zend Framework version 1.11.15 or 1.12.1 or later.
What are the affected versions related to CVE-2012-5657?
Affected versions of Zend Framework include all versions before 1.11.15 and 1.12.1.
What classes are impacted by CVE-2012-5657?
CVE-2012-5657 impacts the Zend_Feed_Rss and Zend_Feed_Atom classes within the Zend_Feed component.
What kind of attacks can CVE-2012-5657 facilitate?
CVE-2012-5657 can facilitate attacks that allow file reads, HTTP requests to intranet servers, and denial of service through increased CPU and memory consumption.