{"id":"CVE-2014-2682","published":"2014-11-16T00:00:00Z","modified":"2024-08-06T10:21:36Z","title":"Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest…","vendor":null,"product":null,"tier":"tail","description":{"text":"Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02182,"percentile":0.82372,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/oss-sec/2014/q2/0","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:072","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://advisories.mageia.org/MGASA-2014-0151.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/66358","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.debian.org/security/2015/dsa-3265","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://framework.zend.com/security/advisory/ZF2014-01","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.47}]},"affected":[{"ecosystem":"Packagist","package":"zendframework/zendframework1","vulnerableRanges":["<1.12.4"],"patched":["1.12.4"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendopenid","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendrest","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-audioscrobbler","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-nirvanix","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-slideshare","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-technorati","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-windowsazure","vulnerableRanges":["<2.0.2"],"patched":["2.0.2"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-amazon","vulnerableRanges":["<2.0.3"],"patched":["2.0.3"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"},{"ecosystem":"Packagist","package":"zendframework/zendservice-api","vulnerableRanges":["<1.0.0"],"patched":["1.0.0"],"from":["GHSA-gp39-h9c2-qw79"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3982","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-zendframework-zendframework1-cve-2012-5657","parents":[{"from":"CVE-2012-5657","to":"CVE-2014-2682","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.","from":"CVE.org","in":"CVE-2014-2682"},{"kind":"version-step","provenance":"source","package":"Packagist:zendframework/zendframework1","fromFixed":"1.12.1","toFixed":"1.12.4","daysApart":563}]}],"packageHistory":[{"cve":"CVE-2012-6532","published":"2013-02-13","fixed":"1.12.0","kev":false},{"cve":"CVE-2012-5657","published":"2013-05-02","fixed":"1.12.1","kev":false},{"cve":"CVE-2014-2681","published":"2014-11-16","fixed":"1.12.4","kev":false},{"cve":"CVE-2014-2682","published":"2014-11-16","fixed":"1.12.4","kev":false},{"cve":"CVE-2014-2683","published":"2014-11-16","fixed":"1.12.4","kev":false},{"cve":"CVE-2014-8088","published":"2014-10-22","fixed":"1.12.9","kev":false},{"cve":"CVE-2014-8089","published":"2020-02-17","fixed":"1.12.9","kev":false}],"package":"Packagist:zendframework/zendframework1"}}