CVE

Id
56606  
CVE No.
CVE-2012-3363  
Status
Candidate  
Description
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.  
Phase
Assigned (20120614)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
585966 56606 CVE-2012-3363 MLIST:[oss-security] 20120626 Re: XXE in Zend  View
585967 56606 CVE-2012-3363 URL:http://www.openwall.com/lists/oss-security/2012/06/26/4  View
585968 56606 CVE-2012-3363 MLIST:[oss-security] 20120626 XXE in Zend  View
585969 56606 CVE-2012-3363 URL:http://www.openwall.com/lists/oss-security/2012/06/26/2  View
585970 56606 CVE-2012-3363 MLIST:[oss-security] 20120627 Re: XXE in Zend  View
585971 56606 CVE-2012-3363 URL:http://www.openwall.com/lists/oss-security/2012/06/27/2  View
585972 56606 CVE-2012-3363 MLIST:[oss-security] 20130325 Moodle security notifications public  View
585973 56606 CVE-2012-3363 URL:http://openwall.com/lists/oss-security/2013/03/25/2  View
585974 56606 CVE-2012-3363 MISC:https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt  View
585975 56606 CVE-2012-3363 CONFIRM:http://framework.zend.com/security/advisory/ZF2012-01  View
585976 56606 CVE-2012-3363 CONFIRM:http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284  View
585977 56606 CVE-2012-3363 CONFIRM:https://moodle.org/mod/forum/discuss.php?d=225345  View
585978 56606 CVE-2012-3363 DEBIAN:DSA-2505  View
585979 56606 CVE-2012-3363 URL:http://www.debian.org/security/2012/dsa-2505  View
585980 56606 CVE-2012-3363 FEDORA:FEDORA-2013-4387  View
585981 56606 CVE-2012-3363 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html  View
585982 56606 CVE-2012-3363 FEDORA:FEDORA-2013-4404  View
585983 56606 CVE-2012-3363 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html  View
585984 56606 CVE-2012-3363 SECTRACK:1027208  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
27279 JVNDB-2012-002986 dtach の attach.cにおける整数符号エラーの脆弱性 dtach の attach.c には、整数符号エラーの脆弱性が存在します。 CVE-2012-3368 56606 2.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002986.html  View