{"id":"CVE-2015-3154","aliases":["CLSA-2026-1771548781","CLSA-2026-1787214807","CLSA-2026-1787781004","DLA-251-1","DSA-3265-1","EUVD-2022-2542","GHSA-5957-5crx-79jx","GHSA-g52p-86j5-xr8q","GHSA-gff2-p6vm-3p8g","MGASA-2015-0241","UBUNTU-CVE-2015-3154"],"status":"published","title":"Zenario CMS vulnerable to CRLF injection","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01009,"percentile":0.6332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-79"],"published":"2015-05-20T00:00:00Z","modified":"2026-10-15T09:48:04Z","fixes":[{"ecosystem":"Packagist","package":"zendframework/zendframework","fixed_in":["2.3.8","2.4.1","2.4.11"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"zendframework/zend-http","fixed_in":["2.3.8","2.4.1","1.12.12"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"zendframework/zendframework1","fixed_in":["1.12.12","1.11.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","fixed_in":["1.11.0-p3+tuxcare"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"php-ZendFramework","fixed_in":["1.12.13-1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0beta4"},{"fixed":"2.3.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0rc1"},{"fixed":"2.4.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0beta4"},{"fixed":"2.3.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0rc1"},{"fixed":"2.4.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.11.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.11"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.10"},{"fixed":"1.12.10-p1+tuxcare"}]}],"versions":["1.12.10"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.0-p3+tuxcare"}]}],"versions":["1.11.0","1.11.0-p1+tuxcare","1.11.0-p2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.6"},{"fixed":"1.10.6-p3+tuxcare"}]}],"versions":["1.10.6","1.10.6-p1+tuxcare","1.10.6-p2+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Debian:6.0","package":"zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1squeeze3"}]}],"versions":["1.10.6-1","1.10.6-1squeeze1","1.10.6-1squeeze2"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-1.1+deb7u1"}]}],"versions":["1.11.13-1.1"],"bundled":9},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0beta4"},{"fixed":"2.3.8"}]}],"versions":["2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.0rc1","2.2.0rc2","2.2.0rc3","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0rc1"},{"fixed":"2.4.1"}]}],"versions":["2.4.0","2.4.0rc1","2.4.0rc2","2.4.0rc3","2.4.0rc4","2.4.0rc5","2.4.0rc6","2.4.0rc7"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0beta4"},{"fixed":"2.3.8"}]}],"versions":["2.0.0","2.0.0beta4","2.0.0beta5","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.0rc6","2.0.0rc7","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.0rc1","2.2.0rc2","2.2.0rc3","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0rc1"},{"fixed":"2.4.1"}]}],"versions":["2.4.0","2.4.0rc1","2.4.0rc2","2.4.0rc3","2.4.0rc4","2.4.0rc5","2.4.0rc6","2.4.0rc7"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.12"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.11.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.11"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.0rc1","2.2.0rc2","2.2.0rc3","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0rc1","2.4.0rc2","2.4.0rc3","2.4.0rc4","2.4.0rc5","2.4.0rc6","2.4.0rc7","2.4.1","2.4.10","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"]},{"source":"osv","ecosystem":"Mageia:4","package":"php-ZendFramework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.13-1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zend-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.11-0ubuntu2","1.11.11-0ubuntu3","1.11.11-0ubuntu3.16.04.1"]}],"products":[{"vendor":"zend","product":"zend_framework"},{"vendor":"zend technologies","product":"zend framework"}],"references":[{"url":"http://framework.zend.com/security/advisory/ZF2015-04","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3154","tags":["advisory"]},{"url":"https://framework.zend.com/security/advisory/ZF2015-04","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-http/CVE-2015-3154.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-3154.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-3154.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5957-5crx-79jx"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2011-01.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20210120123405/https://framework.zend.com/security/advisory/ZF2011-01","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g52p-86j5-xr8q"},{"url":"https://github.com/zendframework/zendframework/commit/7c1e89815f5a9c016f4b8088e59b07cb2bf99dc0","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2016-04.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20201107093523/https://framework.zend.com/security/advisory/ZF2016-04","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gff2-p6vm-3p8g"},{"url":"https://github.com/zendframework/zendframework","tags":["package"]},{"url":"https://github.com/zendframework/zf1","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0241.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15994","tags":["report"]},{"url":"http://framework.zend.com/blog/zend-framework-1-12-10-released.html","tags":["web"]},{"url":"http://framework.zend.com/blog/zend-framework-1-12-11-released.html","tags":["web"]},{"url":"http://framework.zend.com/blog/zend-framework-1-12-12-released.html","tags":["web"]},{"url":"http://framework.zend.com/blog/zend-framework-1-12-13-released.html","tags":["web"]},{"url":"https://www.debian.org/security/2015/dsa-3265","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3154","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3154","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","status":"published","published":"2020-01-27T15:02:12Z","modified":"2024-08-06T05:39:31.844Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2022-2542","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","status":"published","published":"2020-01-27T15:02:12Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-5957-5crx-79jx","title":"Zenario CMS vulnerable to CRLF injection ","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","status":"published","published":"2022-05-24T17:07:24Z","modified":"2024-02-01T19:21:08Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:34.405364Z"},{"id":"GHSA-g52p-86j5-xr8q","title":"ZendFramework Potential Cross-site Scripting in Development Environment Error View Script","description":"The default error handling view script generated using `Zend_Tool` failed to escape request parameters when run in the \"development\" configuration environment, providing a potential XSS attack vector.\n\n`Zend_Tool_Project_Context_Zf_ViewScriptFile` was patched such that the view script template now calls the `escape()` method on dumped request variables.\n\nZend Framework 1.11.4 includes a patch that adds escaping to the generated error/error.phtml view script, ensuring that request variables are escaped appropriately for the browser.\nDo note, however, that this will not update any previously generated code. You will still need to follow the next advice for previously generated error view scripts.","status":"published","published":"2024-06-07T21:20:39Z","modified":"2024-06-07T21:20:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:53.703286Z"},{"id":"GHSA-gff2-p6vm-3p8g","title":"ZendFramework potential remote code execution in zend-mail via Sendmail adapter","description":"When using the zend-mail component to send email via the `Zend\\Mail\\Transport\\Sendmail transport`, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.\n\n","status":"published","published":"2024-06-07T20:47:30Z","modified":"2024-06-07T20:47:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:53.703286Z"}],"nvd":[{"id":"CVE-2015-3154","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","status":"published","published":"2020-01-27T16:15:11.063Z","modified":"2026-06-17T00:25:25.907Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"GHSA-5957-5crx-79jx","title":"Zenario CMS vulnerable to CRLF injection ","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","status":"published","published":"2022-05-24T17:07:24Z","modified":"2024-02-16T07:58:34.368385Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-g52p-86j5-xr8q","title":"ZendFramework Potential Cross-site Scripting in Development Environment Error View Script","description":"The default error handling view script generated using `Zend_Tool` failed to escape request parameters when run in the \"development\" configuration environment, providing a potential XSS attack vector.\n\n`Zend_Tool_Project_Context_Zf_ViewScriptFile` was patched such that the view script template now calls the `escape()` method on dumped request variables.\n\nZend Framework 1.11.4 includes a patch that adds escaping to the generated error/error.phtml view script, ensuring that request variables are escaped appropriately for the browser.\nDo note, however, that this will not update any previously generated code. You will still need to follow the next advice for previously generated error view scripts.","status":"published","published":"2024-06-07T21:20:39Z","modified":"2024-06-07T21:20:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GHSA-gff2-p6vm-3p8g","title":"ZendFramework potential remote code execution in zend-mail via Sendmail adapter","description":"When using the zend-mail component to send email via the `Zend\\Mail\\Transport\\Sendmail transport`, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.\n\n","status":"published","published":"2024-06-07T20:47:30Z","modified":"2024-12-04T05:39:06.67482Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2015-3154","description":"CRLF injection vulnerability in Zend\\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.","status":"published","published":"2020-01-27T16:15:00Z","modified":"2025-10-24T04:45:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"CLSA-2026-1771548781","title":"TuxCare security update for zendframework/zendframework1 (7 CVEs)","description":"TuxCare rebuilt zendframework/zendframework1 to address 7 CVEs. Fixed in 1.12.10-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:04.665174143Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1787214807","title":"TuxCare security update for zendframework/zendframework1 (1 CVE)","description":"TuxCare rebuilt zendframework/zendframework1 to address 1 CVE. Fixed in 1.11.0-p3+tuxcare.","status":"published","published":"2026-08-20T08:33:27Z","modified":"2026-10-15T09:48:00.315908315Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787781004","title":"TuxCare security update for zendframework/zendframework1 (5 CVEs)","description":"TuxCare rebuilt zendframework/zendframework1 to address 5 CVEs. Fixed in 1.10.6-p3+tuxcare.","status":"published","published":"2026-08-26T21:50:04Z","modified":"2026-10-15T09:48:00.349492426Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-251-1","title":"zendframework - security update","status":"published","published":"2015-06-20T00:00:00Z","modified":"2026-03-09T01:17:54.199404Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3265-1","title":"zendframework - security update","status":"published","published":"2015-05-20T00:00:00Z","modified":"2026-03-09T01:20:33.959795Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0241","title":"Updated php-ZendFramework packages fix security vulnerabilities","description":"Updated php-ZendFramework packages fix security vulnerability:\n\nFilippo Tessarotto and Maks3w reported potential CRLF injection attacks in\nmail and HTTP headers in ZendFramework before 1.2.12 (CVE-2015-3154).\n","status":"published","published":"2015-06-08T21:17:51Z","modified":"2026-04-16T06:25:29.363069305Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}