Multiple possibilities for cross-site scripting (XSS) flaws were corrected in upstream 2.0.1 version of Zend Framework: [1] http://framework.zend.com/blog/zend-framework-2-0-1-released.html More from upstream advisory - [2] http://framework.zend.com/security/advisory/ZF2012-03: Zend\Debug, Zend\Feed\PubSubHubbub, Zend\Log\Formatter\Xml, Zend\Tag\Cloud\Decorator, Zend\Uri, Zend\View\Helper\HeadStyle, Zend\View\Helper\Navigation\Sitemap, and Zend\View\Helper\Placeholder\Container\AbstractStandalone were not using Zend\Escaper when escaping HTML, HTML attributes, and/or URLs. While most were performing some escaping, because they were not using context-appropriate escaping mechanisms, they could potentially be exploited to perform Cross Site Scripting (XSS) attacks. Relevant upstream patch: [3] https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
> Relevant upstream patch: > [3] > https://github.com/zendframework/zf2/commit/ > 27131ca9520bdf1d4c774c71459eba32f2b10733 While the above referenced upstream patch is against 2.0.1 branch, after backport / modification it would be applicable also against ZendFramework-1.x versions: Upstream ZF2 version: - Fedora / EPEL ZF1 version: ------------------------------------------------------------- 1) library/Zend/Debug/Debug.php => library/Zend/Debug.php, 2) library/Zend/Feed/PubSubHubbub/PubSubHubbub.php => library/Zend/Feed/Pubsubhubbub.php: 141 /** 142 * RFC 3986 safe url encoding method 143 * 144 * @param string $string 145 * @return string 146 */ 147 public static function urlencode($string) is the same in both versions (similarly would apply for other parts of upstream patch above).
This issue affects the versions of the php-ZendFramework package, as shipped with Fedora release of 16 and 17. Please schedule an update. -- This issue affects the version of the php-ZendFramework package, as shipped with Fedora EPEL 6. Please schedule an update.
Created php-ZendFramework tracking bugs for this issue Affects: fedora-all [bug 860744] Affects: epel-6 [bug 860745]
CVE request: [4] http://www.openwall.com/lists/oss-security/2012/09/26/7
This was assigned CVE-2012-4451: http://www.openwall.com/lists/oss-security/2012/09/26/9
Fixed in 1.12.1 which we are shipping by now.