{"id":"CVE-2012-5657","published":"2013-05-02T14:00:00Z","modified":"2024-08-06T21:14:16Z","title":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x…","vendor":null,"product":null,"tier":"tail","description":{"text":"The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01705,"percentile":0.77195,"provenance":"source"},"cwes":[],"references":[{"url":"http://openwall.com/lists/oss-security/2012/12/20/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.debian.org/security/2012/dsa-2602","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:115","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://framework.zend.com/security/advisory/ZF2012-05","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/51583","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://openwall.com/lists/oss-security/2012/12/20/4","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":15.44}]},"affected":[{"ecosystem":"Packagist","package":"zendframework/zendframework1","vulnerableRanges":["<1.11.15",">=1.12.0-rc1, <1.12.1"],"patched":["1.11.15","1.12.1"],"from":["GHSA-9m5v-vq4f-mrvf"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3410","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-zendframework-zendframework1-cve-2012-3363","children":[{"from":"CVE-2012-5657","to":"CVE-2014-2681","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.","from":"CVE.org","in":"CVE-2014-2681"},{"kind":"version-step","provenance":"source","package":"Packagist:zendframework/zendframework1","fromFixed":"1.12.1","toFixed":"1.12.4","daysApart":563}]},{"from":"CVE-2012-5657","to":"CVE-2014-2682","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.","from":"CVE.org","in":"CVE-2014-2682"},{"kind":"version-step","provenance":"source","package":"Packagist:zendframework/zendframework1","fromFixed":"1.12.1","toFixed":"1.12.4","daysApart":563}]},{"from":"CVE-2012-5657","to":"CVE-2015-5161","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["library/Zend/Feed.php","library/Zend/Feed/Abstract.php"],"commits":["https://github.com/zendframework/zf1/commit/15c84914f063efea49ea1c4425459a792cc185ea","https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2012-3363","published":"2013-02-13","fixed":"1.12.0","kev":false},{"cve":"CVE-2012-6531","published":"2013-02-13","fixed":"1.12.0","kev":false,"link":{"from":"CVE-2012-6531","to":"CVE-2012-5657","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:zendframework/zendframework1","fromFixed":"1.11.13","toFixed":"1.11.15","daysApart":78}]}},{"cve":"CVE-2012-6532","published":"2013-02-13","fixed":"1.12.0","kev":false},{"cve":"CVE-2012-5657","published":"2013-05-02","fixed":"1.12.1","kev":false},{"cve":"CVE-2014-2681","published":"2014-11-16","fixed":"1.12.4","kev":false},{"cve":"CVE-2014-2682","published":"2014-11-16","fixed":"1.12.4","kev":false},{"cve":"CVE-2014-2683","published":"2014-11-16","fixed":"1.12.4","kev":false,"link":{"from":"CVE-2012-5657","to":"CVE-2014-2683","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:zendframework/zendframework1","fromFixed":"1.12.1","toFixed":"1.12.4","daysApart":563}]}}],"package":"Packagist:zendframework/zendframework1"}}