CVE-2014-2682

Published: Nov 16, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.

Affected (12)

Products: Zend: Zendrest, Zend Framework, Zendservice Slideshare, Zendservice Api, Zendservice Audioscrobbler, Zendservice Amazon, Zendservice Technorati, Zendservice Windowsazure, Zendopenid, Zendservice Nirvanix

10 products

Zendservice Slideshare

Zendservice Api

Zendservice Audioscrobbler

Zendservice Amazon

Zendservice Technorati

Zendservice Windowsazure

Zendservice Nirvanix

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendrest	Up to 2.0.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Zend Zend Framework	Before 1.12.4
Zend Zend Framework	From 2.1.0 to 2.1.6
Zend Zend Framework	From 2.2.0 to 2.2.6

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Slideshare	Up to 2.0.1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Api	Up to 1.0.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Audioscrobbler	Up to 2.0.1

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Amazon	Up to 2.0.2

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Technorati	Up to 2.0.1

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Windowsazure	Up to 2.0.1

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendopenid	Up to 2.0.1

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Zend Zendservice Nirvanix	Up to 2.0.1

Related CWEs

References (12)

http://advisories.mageia.org/MGASA-2014-0151.html

Source: cve@mitre.org

Third Party Advisory

http://framework.zend.com/security/advisory/ZF2014-01

Source: cve@mitre.org

Vendor Advisory

http://seclists.org/oss-sec/2014/q2/0

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.debian.org/security/2015/dsa-3265

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2014:072

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/66358

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://advisories.mageia.org/MGASA-2014-0151.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://framework.zend.com/security/advisory/ZF2014-01

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://seclists.org/oss-sec/2014/q2/0

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.debian.org/security/2015/dsa-3265

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2014:072

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/66358

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.