Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
197
security advisorydebianinformation disclosureDebian: DLA-3493-1 Critical Advisory on Symfony Impersonation Risks
Multiple security vulnerabilities were found in symfony, a PHP framework for web and console applications and a set of reusable PHP components, which could lead to information disclosure or impersonation. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3493-1
Jul 11, 2023
•Critical
Debian LTS
89
security advisoryFedorasql injectionFedora 23: php-ZendFramework Security Update EOL: SQL Issues
Probably the last update for Zend Framework 1 as it is being EOLd on September 28, 2016. Fixes two security issues, CVE-2016-4861 and CVE-2016-6233. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-77e5105570 2016-10-09 02:26:02.589913 -------------------------------------------------------------------------------- Name : php-ZendFramework Product : Fedora 23 Version : 1.12.20 Release : 1.fc23 URL : https://framework.zend.com/ Summary : Leading open-source PHP framework Description : Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorously tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and consuming widely available APIs from leading vendors like Google, Amazon, Yahoo!, Flickr, as well as API providers and catalogers like StrikeIron and ProgrammableWeb. -------------------------------------------------------------------------------- Update Information: Probably the last update for Zend Framework 1 as it is being EOLd on September 28, 2016. Fixes two security issues, CVE-2016-4861 and CVE-2016-6233 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1376341 - CVE-2016-4861 php-ZendFramework: ZendFramework: SQL injection vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1376341 [ 2 ] Bug #1357553 - CVE-2016-6233 php-ZendFramework: ZendFramework: Potential SQL injection in ORDER and GROUP statements of Zend_Db_Select [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1357553 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework' at the command line. For more information, refer to "Managing Software withyum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 09, 2016
•Critical
Fedora
89
security advisoryfedorasoftware updateFedora 23: 2015-2e7c06c639 Moderate: php-ZendFramework XML Injection Fixes
Update to 1.12.16 - fixes CVE-2015-5161: https://framework.zend.com/security/advisory/ZF2015-06 - fixes CVE-2015-5723: https://framework.zend.com/security/advisory/ZF2015-07 - removed services: DeveloperGarden, Technorati. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-2e7c06c639 2015-11-08 21:07:00.335689 -------------------------------------------------------------------------------- Name : php-ZendFramework Product : Fedora 23 Version : 1.12.16 Release : 1.fc23 URL : https://framework.zend.com/ Summary : Leading open-source PHP framework Description : Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorously tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and consuming widely available APIs from leading vendors like Google, Amazon, Yahoo!, Flickr, as well as API providers and catalogers like StrikeIron and ProgrammableWeb. -------------------------------------------------------------------------------- Update Information: Update to 1.12.16 - fixes CVE-2015-5161: https://framework.zend.com/security/advisory/ZF2015-06 - fixes CVE-2015-5723: https://framework.zend.com/security/advisory/ZF2015-07 - removed services: DeveloperGarden, Technorati -------------------------------------------------------------------------------- References: [ 1 ] Bug #1269080 - CVE-2015-5723 php-ZendFramework: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1269080 [ 2 ] Bug #1253255 - CVE-2015-5161 php-ZendFramework: XML external entity injection (XXE) on PHP FPM [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1253255 [ 3 ] Bug #1253253 - CVE-2015-5161 php-ZendFramework: XML external entity injection (XXE) on PHP FPM [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1253253 [ 4 ] Bug#1269081 - CVE-2015-5723 php-ZendFramework: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1269081 [ 5 ] Bug #1253251 - CVE-2015-5161 php-ZendFramework: XML external entity injection (XXE) on PHP FPM [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1253251 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Nov 08, 2015
•Important
Fedora
89
security advisoryfedoracode executionFedora 22: 2015-16034 Urgent: php-ZendFramework2 Local Code Execution
**Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrary code execution and/or local privilege escalation. This release contains a patch that ensures the directories are created using permissions of 0775 and files using 0664 (essentially umask 0002). **Bug. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-16034 2015-09-25 07:42:11.255511 -------------------------------------------------------------------------------- Name : php-ZendFramework2 Product : Fedora 22 Version : 2.4.8 Release : 1.fc22 URL : https://framework.zend.com/ Summary : Zend Framework 2 Description : Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework with over 15 million downloads. Note: This meta package installs all base Zend Framework component packages (Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db, Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n, InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager, Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar, Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text, Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and Cache-memcached packages. -------------------------------------------------------------------------------- Update Information: **Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrarycode execution and/or local privilege escalation. This release contains a patch that ensures the directories are created using permissions of 0775 and files using 0664 (essentially umask 0002). **Bug fixed** from upstream [Changelog]() * validate against DateTimeImmutable instead of DateTimeInterface * treat 0.0 as non-empty, restoring pre-2.4 behavior * deprecate "magic" logic for auto- attaching NonEmpty validators in favor of explicit attachment * ensure fallback values work as per pre-2.4 behavior * update the InputFilterInterface::add() docblock to match implementations * Fix how missing optoinal fields are validated to match pre 2.4.0 behavior * deprecate AllowEmpty and ContinueIfEmpty annotations, per zend-inputfilter#26 * fix typos in aria attribute names of AbstractHelper * fixes the ContentType header to properly handle encoded parameter values * fixes the Sender header to allow mailbox addresses without TLDs * fixes parsing of messages that contain an initial blank line before headers * fixes the SetCookie header to allow multiline values (as they are always encoded * fixes DefaultRenderingStrategy errors due to controllersreturning non-view model results -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 25, 2015
•Critical
Fedora
89
security advisoryFedoracritical patchFedora 23 ZF2015-07 Critical: php-ZendFramework2 Local Escalation Risk
**Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrary code execution and/or local privilege escalation. This release contains a patch that ensures the directories are created using permissions of 0775 and files using 0664 (essentially umask 0002). **Bug. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-16033 2015-09-25 07:56:18.561837 -------------------------------------------------------------------------------- Name : php-ZendFramework2 Product : Fedora 23 Version : 2.4.8 Release : 1.fc23 URL : https://framework.zend.com/ Summary : Zend Framework 2 Description : Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework with over 15 million downloads. Note: This meta package installs all base Zend Framework component packages (Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db, Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n, InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager, Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar, Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text, Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and Cache-memcached packages. -------------------------------------------------------------------------------- Update Information: **Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrarycode execution and/or local privilege escalation. This release contains a patch that ensures the directories are created using permissions of 0775 and files using 0664 (essentially umask 0002). **Bug fixed** from upstream [Changelog]() * validate against DateTimeImmutable instead of DateTimeInterface * treat 0.0 as non-empty, restoring pre-2.4 behavior * deprecate "magic" logic for auto- attaching NonEmpty validators in favor of explicit attachment * ensure fallback values work as per pre-2.4 behavior * update the InputFilterInterface::add() docblock to match implementations * Fix how missing optoinal fields are validated to match pre 2.4.0 behavior * deprecate AllowEmpty and ContinueIfEmpty annotations, per zend-inputfilter#26 * fix typos in aria attribute names of AbstractHelper * fixes the ContentType header to properly handle encoded parameter values * fixes the Sender header to allow mailbox addresses without TLDs * fixes parsing of messages that contain an initial blank line before headers * fixes the SetCookie header to allow multiline values (as they are always encoded * fixes DefaultRenderingStrategy errors due to controllersreturning non-view model results -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 25, 2015
•Critical
Fedora
89
security advisorysecurity updateFedoraFedora 21: FEDORA-2015-13488 Moderate: XML Injection in php-ZendFramework2
Zend Framework Upstream ChangeLogs: * [Version 2.4.7]() * [Version 2.4.6]() * [Version 2.4.5]() * [Version 2.4.4]() * [Version. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-13488 2015-08-27 19:40:20.011512 -------------------------------------------------------------------------------- Name : php-ZendFramework2 Product : Fedora 21 Version : 2.4.7 Release : 1.fc21 URL : https://framework.zend.com/ Summary : Zend Framework 2 Description : Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework with over 15 million downloads. Note: This meta package installs all base Zend Framework component packages (Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db, Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n, InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager, Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar, Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text, Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and Cache-memcached packages. -------------------------------------------------------------------------------- Update Information: Zend Framework Upstream ChangeLogs: * [Version 2.4.7]() * [Version 2.4.6]() * [Version 2.4.5]() * [Version 2.4.4]() * [Version 2.4.3]() * [Version 2.4.2]() * [Version 2.4.1]() * [Version 2.4.0]() -------------------------------------------------------------------------------- References: [ 1 ] Bug #1253250 - CVE-2015-5161 php-ZendFramework: XML external entity injection (XXE) on PHP FPM https://bugzilla.redhat.com/show_bug.cgi?id=1253250 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Aug 27, 2015
•Important
Fedora
89
security advisoryupdateFedoraFedora 22 FEDORA-2015-13529 Critical: php-ZendFramework2 XML Injection
Zend Framework Upstream ChangeLogs: * [Version 2.4.7]() * [Version 2.4.6]() * [Version 2.4.5]() * [Version 2.4.4]() * [Version. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-13529 2015-08-27 17:52:04.306883 -------------------------------------------------------------------------------- Name : php-ZendFramework2 Product : Fedora 22 Version : 2.4.7 Release : 1.fc22 URL : https://framework.zend.com/ Summary : Zend Framework 2 Description : Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework with over 15 million downloads. Note: This meta package installs all base Zend Framework component packages (Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db, Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n, InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager, Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar, Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text, Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and Cache-memcached packages. -------------------------------------------------------------------------------- Update Information: Zend Framework Upstream ChangeLogs: * [Version 2.4.7]() * [Version 2.4.6]() * [Version 2.4.5]() * [Version 2.4.4]() * [Version 2.4.3]() * [Version 2.4.2]() * [Version 2.4.1]() * [Version 2.4.0]() -------------------------------------------------------------------------------- References: [ 1 ] Bug #1253250 - CVE-2015-5161 php-ZendFramework: XML external entity injection (XXE) on PHP FPM https://bugzilla.redhat.com/show_bug.cgi?id=1253250 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Aug 27, 2015
•Critical
Fedora
89
security advisorysoftware updateFedoraFedora: 2015-13314 Critical: PHP-ZendFramework2 XML Injection
Zend Framework Upstream ChangeLog: * [Version 2.4.7]() * [Version 2.4.6]() * [Version 2.4.5]() * [Version 2.4.4]() * [Version. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-13314 2015-08-22 17:35:49.834756 -------------------------------------------------------------------------------- Name : php-ZendFramework2 Product : Fedora 23 Version : 2.4.7 Release : 1.fc23 URL : https://framework.zend.com/ Summary : Zend Framework 2 Description : Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework with over 15 million downloads. Note: This meta package installs all base Zend Framework component packages (Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db, Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n, InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager, Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar, Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text, Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and Cache-memcached packages. -------------------------------------------------------------------------------- Update Information: Zend Framework Upstream ChangeLog: * [Version 2.4.7]() * [Version 2.4.6]() * [Version 2.4.5]() * [Version 2.4.4]() * [Version 2.4.3]() * [Version 2.4.2]() * [Version 2.4.1]() * [Version 2.4.0]() -------------------------------------------------------------------------------- References: [ 1 ] Bug #1253250 - CVE-2015-5161 php-ZendFramework: XML external entity injection (XXE) on PHP FPM https://bugzilla.redhat.com/show_bug.cgi?id=1253250 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Aug 22, 2015
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!