{"id":"CVE-2012-6532","published":"2013-02-13T17:00:00Z","modified":"2024-08-06T21:28:39Z","title":"(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before…","vendor":null,"product":null,"tier":"tail","description":{"text":"(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01848,"percentile":0.78996,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:115","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://framework.zend.com/security/advisory/ZF2012-02","tags":["x_refsource_CONFIRM"]}],"priority":{"score":15.8,"factors":[{"name":"EPSS percentile","points":15.8}]},"affected":[{"ecosystem":"Packagist","package":"zendframework/zendframework1","vulnerableRanges":[">=1.0, <1.11.13",">=1.12.0-rc1, <1.12.0"],"patched":["1.11.13","1.12.0"],"from":["GHSA-jh4x-4wmf-67pr"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4369","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-zendframework-zendframework1-cve-2012-3363","parents":[{"from":"CVE-2012-3363","to":"CVE-2012-6532","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:zendframework/zendframework1","fromFixed":"1.11.12","toFixed":"1.11.13","daysApart":0},{"kind":"same-code","provenance":"machine","files":["library/Zend/XmlRpc/Request.php","library/Zend/XmlRpc/Response.php"],"commits":["https://github.com/zendframework/zf1/commit/281a3251d71ed40a5289ec4afc355eea8e014dc5","https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db"],"basis":"shared function","functions":["loadXml"]},{"kind":"similar","provenance":"machine","score":0.27,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2012-6532","to":"CVE-2014-2683","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.","from":"CVE.org","in":"CVE-2014-2683"},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same package + description similarity"}]},{"from":"CVE-2012-6532","to":"CVE-2015-5161","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["library/Zend/Dom/Query.php","library/Zend/Feed/Reader.php","library/Zend/Serializer/Adapter/Wddx.php","library/Zend/Soap/Server.php","library/Zend/Soap/Wsdl.php"],"commits":["https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db","https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b"],"basis":"shared function","functions":["__construct","_setRequest","detectType","importFeed","loadXml"]}]}],"packageHistory":[{"cve":"CVE-2012-3363","published":"2013-02-13","fixed":"1.12.0","kev":false},{"cve":"CVE-2012-6531","published":"2013-02-13","fixed":"1.12.0","kev":false},{"cve":"CVE-2012-6532","published":"2013-02-13","fixed":"1.12.0","kev":false},{"cve":"CVE-2012-5657","published":"2013-05-02","fixed":"1.12.1","kev":false},{"cve":"CVE-2014-2681","published":"2014-11-16","fixed":"1.12.4","kev":false},{"cve":"CVE-2014-2682","published":"2014-11-16","fixed":"1.12.4","kev":false}],"package":"Packagist:zendframework/zendframework1"}}