CVE-2012-6532: XEE
(1) ZendDom, (2) ZendFeed, (3) ZendSoap, and (4) ZendXmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.
Other sources
(1) ZendDom, (2) ZendFeed, (3) ZendSoap, and (4) ZendXmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6532?
CVE-2012-6532 has been classified as a denial of service vulnerability, specifically affecting CPU consumption.
How do I fix CVE-2012-6532?
To address CVE-2012-6532, upgrade to Zend Framework version 1.12.0 or 1.11.13.
Which versions of Zend Framework are affected by CVE-2012-6532?
CVE-2012-6532 affects Zend Framework 1.x versions prior to 1.11.13 and 1.12.x prior to 1.12.0.
What components are impacted by CVE-2012-6532?
The components impacted by CVE-2012-6532 include Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc within Zend Framework.
Can CVE-2012-6532 be exploited remotely?
Yes, CVE-2012-6532 can be exploited by remote attackers through recursive or circular references in XML entity definitions.