Mageia alert MGASA-2012-0200 (php-ZendFramework)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2012-0200:
 php-ZendFramework-1.11.0-1.1.mga1 (1/core),
 php-ZendFramework-1.11.11-1.1.mga2 (2/core) 
Date:
    	     
 
Mon, 6 Aug 2012 18:27:14 +0200
Message-ID:
    	     
 
<20120806162714.GA32766@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2012-0200
Date: 	August 6th, 2012
Affected releases: 	1, 2


Description:
Updated php-ZendFramework packages fix a security vulnerability:

A file disclosure flaw was found in the way SimpleXMLElement class of
Zend Framework, a PHP framework, processed XML data provided within
certain XML-RPC requests (external XML entities were previously
possible to specify by adding a specific DOCTYPE element to particular
XML-RPC request). A remote attacker could use this flaw to obtain
sensitive information by issuing a specially-crafted XML-RPC request
to the Zend Framework based PHP application (CVE-2012-3363).


Updated Packages:
Mageia 1:
php-ZendFramework-1.11.0-1.1.mga1
php-ZendFramework-demos-1.11.0-1.1.mga1
php-ZendFramework-extras-1.11.0-1.1.mga1
php-ZendFramework-tests-1.11.0-1.1.mga1
php-ZendFramework-Cache-Backend-Apc-1.11.0-1.1.mga1
php-ZendFramework-Cache-Backend-Memcached-1.11.0-1.1.mga1
php-ZendFramework-Captcha-1.11.0-1.1.mga1
php-ZendFramework-Dojo-1.11.0-1.1.mga1
php-ZendFramework-Feed-1.11.0-1.1.mga1
php-ZendFramework-Gdata-1.11.0-1.1.mga1
php-ZendFramework-Pdf-1.11.0-1.1.mga1
php-ZendFramework-Search-Lucene-1.11.0-1.1.mga1
php-ZendFramework-Services-1.11.0-1.1.mga1

Mageia 2:
php-ZendFramework-1.11.11-1.1.mga2
php-ZendFramework-demos-1.11.11-1.1.mga2
php-ZendFramework-extras-1.11.11-1.1.mga2
php-ZendFramework-tests-1.11.11-1.1.mga2
php-ZendFramework-Captcha-1.11.11-1.1.mga2
php-ZendFramework-Cache-Backend-Apc-1.11.11-1.1.mga2
php-ZendFramework-Cache-Backend-Memcached-1.11.11-1.1.mga2
php-ZendFramework-Dojo-1.11.11-1.1.mga2
php-ZendFramework-Feed-1.11.11-1.1.mga2
php-ZendFramework-Gdata-1.11.11-1.1.mga2
php-ZendFramework-Search-Lucene-1.11.11-1.1.mga2
php-ZendFramework-Pdf-1.11.11-1.1.mga2
php-ZendFramework-Services-1.11.11-1.1.mga2


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3363
http://framework.zend.com/security/advisory/ZF2012-01
https://bugzilla.redhat.com/show_bug.cgi?id=835560
http://www.debian.org/security/2012/dsa-2505
https://bugs.mageia.org/show_bug.cgi?id=6666
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-...