CVE-2012-6531: Input Validation
First published: Wed Feb 13 2013(Updated: )
(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/zendframework/zendframework1 | >=1.12.0-rc1<1.12.0 | 1.12.0 |
| composer/zendframework/zendframework1 | >=1.0<1.11.13 | 1.11.13 |
| Zend Zend Framework | =1.0.4 | |
| Zend Zend Framework | =1.5.0 | |
| Zend Zend Framework | =1.5.1 | |
| Zend Zend Framework | =1.5.2 | |
| Zend Zend Framework | =1.5.3 | |
| Zend Zend Framework | =1.6.0 | |
| Zend Zend Framework | =1.6.1 | |
| Zend Zend Framework | =1.6.2 | |
| Zend Zend Framework | =1.7.0 | |
| Zend Zend Framework | =1.7.1 | |
| Zend Zend Framework | =1.7.2 | |
| Zend Zend Framework | =1.7.3 | |
| Zend Zend Framework | =1.7.4 | |
| Zend Zend Framework | =1.7.5 | |
| Zend Zend Framework | =1.7.6 | |
| Zend Zend Framework | =1.7.7 | |
| Zend Zend Framework | =1.7.8 | |
| Zend Zend Framework | =1.7.9 | |
| Zend Zend Framework | =1.8.0 | |
| Zend Zend Framework | =1.8.1 | |
| Zend Zend Framework | =1.8.2 | |
| Zend Zend Framework | =1.8.3 | |
| Zend Zend Framework | =1.8.4 | |
| Zend Zend Framework | =1.8.5 | |
| Zend Zend Framework | =1.9.0 | |
| Zend Zend Framework | =1.9.1 | |
| Zend Zend Framework | =1.9.2 | |
| Zend Zend Framework | =1.9.3 | |
| Zend Zend Framework | =1.9.4 | |
| Zend Zend Framework | =1.9.5 | |
| Zend Zend Framework | =1.9.6 | |
| Zend Zend Framework | =1.9.7 | |
| Zend Zend Framework | =1.9.8 | |
| Zend Zend Framework | =1.10.0 | |
| Zend Zend Framework | =1.10.1 | |
| Zend Zend Framework | =1.10.2 | |
| Zend Zend Framework | =1.10.3 | |
| Zend Zend Framework | =1.10.4 | |
| Zend Zend Framework | =1.10.5 | |
| Zend Zend Framework | =1.10.6 | |
| Zend Zend Framework | =1.10.7 | |
| Zend Zend Framework | =1.10.8 | |
| Zend Zend Framework | =1.11.0 | |
| Zend Zend Framework | =1.11.1 | |
| Zend Zend Framework | =1.11.2 | |
| Zend Zend Framework | =1.11.3 | |
| Zend Zend Framework | =1.11.4 | |
| Zend Zend Framework | =1.11.5 | |
| Zend Zend Framework | =1.11.6 | |
| Zend Zend Framework | =1.11.7 | |
| Zend Zend Framework | =1.11.8 | |
| Zend Zend Framework | =1.11.9 | |
| Zend Zend Framework | =1.11.10 | |
| Zend Zend Framework | =1.11.11 | |
| Zend Zend Framework | =1.11.12 | |
| Zend Zend Framework | =1.12.0-rc1 | |
| Zend Zend Framework | =1.12.0-rc2 | |
| Zend Zend Framework | =1.12.0-rc3 | |
| Zend Zend Framework | =1.12.0-rc4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2012-6531
- https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
- http://framework.zend.com/security/advisory/ZF2012-01
- http://www.debian.org/security/2012/dsa-2505
- http://www.openwall.com/lists/oss-security/2012/06/26/2
- http://www.openwall.com/lists/oss-security/2012/06/26/4
- http://www.openwall.com/lists/oss-security/2012/06/27/2
- https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db
- https://github.com/advisories/GHSA-h5p3-7mg6-hgj4 (Advisory)
- collector/nvd-index
- agent/type
- agent/references
- agent/author
- agent/severity
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-h5p3-7mg6-hgj4
- alias/CVE-2012-6531
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/description
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/zend
- canonical/zend zend framework
- version/zend zend framework/1.0.4
- version/zend zend framework/1.5.0
- version/zend zend framework/1.5.1
- version/zend zend framework/1.5.2
- version/zend zend framework/1.5.3
- version/zend zend framework/1.6.0
- version/zend zend framework/1.6.1
- version/zend zend framework/1.6.2
- version/zend zend framework/1.7.0
- version/zend zend framework/1.7.1
- version/zend zend framework/1.7.2
- version/zend zend framework/1.7.3
- version/zend zend framework/1.7.4
- version/zend zend framework/1.7.5
- version/zend zend framework/1.7.6
- version/zend zend framework/1.7.7
- version/zend zend framework/1.7.8
- version/zend zend framework/1.7.9
- version/zend zend framework/1.8.0
- version/zend zend framework/1.8.1
- version/zend zend framework/1.8.2
- version/zend zend framework/1.8.3
- version/zend zend framework/1.8.4
- version/zend zend framework/1.8.5
- version/zend zend framework/1.9.0
- version/zend zend framework/1.9.1
- version/zend zend framework/1.9.2
- version/zend zend framework/1.9.3
- version/zend zend framework/1.9.4
- version/zend zend framework/1.9.5
- version/zend zend framework/1.9.6
- version/zend zend framework/1.9.7
- version/zend zend framework/1.9.8
- version/zend zend framework/1.10.0
- version/zend zend framework/1.10.1
- version/zend zend framework/1.10.2
- version/zend zend framework/1.10.3
- version/zend zend framework/1.10.4
- version/zend zend framework/1.10.5
- version/zend zend framework/1.10.6
- version/zend zend framework/1.10.7
- version/zend zend framework/1.10.8
- version/zend zend framework/1.11.0
- version/zend zend framework/1.11.1
- version/zend zend framework/1.11.2
- version/zend zend framework/1.11.3
- version/zend zend framework/1.11.4
- version/zend zend framework/1.11.5
- version/zend zend framework/1.11.6
- version/zend zend framework/1.11.7
- version/zend zend framework/1.11.8
- version/zend zend framework/1.11.9
- version/zend zend framework/1.11.10
- version/zend zend framework/1.11.11
- version/zend zend framework/1.11.12
- version/zend zend framework/1.12.0-rc1
- version/zend zend framework/1.12.0-rc2
- version/zend zend framework/1.12.0-rc3
- version/zend zend framework/1.12.0-rc4
- package-manager/composer