oss-sec mailing list archives
CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02
From: Murray McAllister <mmcallis () redhat com>
Date: Thu, 27 Mar 2014 13:16:50 +1100
Good morning,http://framework.zend.com/security/advisory/ZF2014-01 fixes XML eXternal Entity (XXE) and XML Entity Expansion (XEE) flaws in the Zend Framework.
http://framework.zend.com/security/advisory/ZF2014-02 fixes an issue where an OpenID identity provider could be used to spoof other identity providers.
Could CVEs please be assigned if they have not been already? References: https://bugs.gentoo.org/show_bug.cgi?id=505276 https://secunia.com/advisories/57276/ https://bugzilla.redhat.com/show_bug.cgi?id=1081287 https://bugzilla.redhat.com/show_bug.cgi?id=1081288 Cheers, -- Murray McAllister / Red Hat Security Response Team
Current thread:
- CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02 Murray McAllister (Mar 26)