[SECURITY] [DLA 326-1] zendframework security update

2015-10-1521:07:52

lists.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.016

Percentile

87.6%

JSON

Package : zendframework
Version : 1.10.6-1squeeze6
CVE ID : CVE-2015-7695

The PDO adapters of Zend Framework 1 did not filter null bytes values in
SQL statements. A PDO adapter can treat null bytes in a query as a
string terminator, allowing an attacker to add arbitrary SQL following a
null byte, and thus create a SQL injection.

For Debian 6 Squeeze, this issue has been fixed in zendframework
version 1.10.6-1squeeze6.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian7allzendframework-resources< 1.11.13-1.1+deb7u4zendframework-resources_1.11.13-1.1+deb7u4_all.deb
Debian6allzendframework-bin< 1.10.6-1squeeze6zendframework-bin_1.10.6-1squeeze6_all.deb
Debian7allzendframework-bin< 1.11.13-1.1+deb7u4zendframework-bin_1.11.13-1.1+deb7u4_all.deb
Debian6allzendframework< 1.10.6-1squeeze6zendframework_1.10.6-1squeeze6_all.deb
Debian8allzendframework< 1.12.9+dfsg-2+deb8u4zendframework_1.12.9+dfsg-2+deb8u4_all.deb
Debian7allzendframework< 1.11.13-1.1+deb7u4zendframework_1.11.13-1.1+deb7u4_all.deb
Debian8allzendframework-resources< 1.12.9+dfsg-2+deb8u4zendframework-resources_1.12.9+dfsg-2+deb8u4_all.deb
Debian8allzendframework-bin< 1.12.9+dfsg-2+deb8u4zendframework-bin_1.12.9+dfsg-2+deb8u4_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	zendframework-resources	< 1.11.13-1.1+deb7u4	zendframework-resources_1.11.13-1.1+deb7u4_all.deb
Debian	6	all	zendframework-bin	< 1.10.6-1squeeze6	zendframework-bin_1.10.6-1squeeze6_all.deb
Debian	7	all	zendframework-bin	< 1.11.13-1.1+deb7u4	zendframework-bin_1.11.13-1.1+deb7u4_all.deb
Debian	6	all	zendframework	< 1.10.6-1squeeze6	zendframework_1.10.6-1squeeze6_all.deb
Debian	8	all	zendframework	< 1.12.9+dfsg-2+deb8u4	zendframework_1.12.9+dfsg-2+deb8u4_all.deb
Debian	7	all	zendframework	< 1.11.13-1.1+deb7u4	zendframework_1.11.13-1.1+deb7u4_all.deb
Debian	8	all	zendframework-resources	< 1.12.9+dfsg-2+deb8u4	zendframework-resources_1.12.9+dfsg-2+deb8u4_all.deb
Debian	8	all	zendframework-bin	< 1.12.9+dfsg-2+deb8u4	zendframework-bin_1.12.9+dfsg-2+deb8u4_all.deb