The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| zendframework/zendframework(Packagist) | 2.0.0 | 2.4.6 | N/A |
| zendframework/zendframework(Packagist) | 2.5.0 | 2.5.2 | N/A |
| zendframework/zendframework1(Packagist) | 1.12.0 | 1.12.14 | N/A |
| zendframework/zendxml(Packagist) | 1.0.0 | 1.0.1 | N/A |
| zendframework/zendframework(Packagist) | 1.12.0 | 1.12.14 | N/A |
CVSS Metrics
