CVE-2014-2682: XEE
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendServiceAudioScrobbler, ZendServiceNirvanix, ZendServiceSlideShare, ZendServiceTechnorati, and ZendServiceWindowsAzure before 2.0.2, ZendServiceAmazon before 2.0.3, and ZendServiceApi before 1.0.0, when PHP-FPM is used, does not properly share the libxmldisableentityloader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2682?
CVE-2014-2682 is classified as a high severity vulnerability affecting multiple Zend Framework components.
How do I fix CVE-2014-2682?
To fix CVE-2014-2682, update to Zend Framework 1.12.4, Zend Framework 2.1.6 or 2.2.6, or the specific patched versions of affected Zend services.
Which versions of Zend Framework are affected by CVE-2014-2682?
CVE-2014-2682 affects Zend Framework 1 versions prior to 1.12.4 and Zend Framework 2 versions before 2.1.6 and 2.2.x before 2.2.6.
What components are impacted by CVE-2014-2682?
CVE-2014-2682 impacts various components such as ZendOpenId, ZendRest, and other ZendService packages.
Is there a workaround for CVE-2014-2682?
There is no specific workaround for CVE-2014-2682; updating to the appropriate secure versions is recommended.