{"id":"CVE-2015-5723","aliases":["CLSA-2026-1771548781","CLSA-2026-1787038633","CLSA-2026-1787221779","DEBIAN-CVE-2015-5723","DSA-3369-1","EUVD-2022-4834","GHSA-229x-22xc-2f2w","GHSA-2x36-qhx3-7m5f","GHSA-9v78-h226-2rmq","GHSA-gff2-p6vm-3p8g","GHSA-mhpx-3rv8-wrjm","GHSA-pw5c-xqf2-6xc2","MGASA-2015-0391","UBUNTU-CVE-2015-5723"],"status":"published","title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00381,"percentile":0.32404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-287","CWE-611","CWE-74","CWE-776","CWE-89"],"published":"2015-10-06T00:00:00Z","modified":"2026-10-15T09:48:04Z","fixes":[{"ecosystem":"Packagist","package":"zendframework/zendframework1","fixed_in":["1.11.13","1.12.7","1.12.4","1.12.16"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"zendframework/zendframework","fixed_in":["2.4.11","2.4.8"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"doctrine/annotations","fixed_in":["1.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"doctrine/cache","fixed_in":["1.4.2","1.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"doctrine/common","fixed_in":["2.4.3","2.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"doctrine/orm","fixed_in":["2.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"doctrine/mongodb-odm","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"doctrine/mongodb-odm-bundle","fixed_in":["3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"zendframework/zend-cache","fixed_in":["2.5.3","2.4.8"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"aws/aws-sdk-php","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"zfcampus/zf-apigility-doctrine","fixed_in":["1.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","fixed_in":["1.10.6-p2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"doctrine","fixed_in":["2.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"doctrine","fixed_in":["2.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"doctrine","fixed_in":["2.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-doctrine-annotations","fixed_in":["1.2.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-doctrine-annotations","fixed_in":["1.2.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-doctrine-annotations","fixed_in":["1.2.7-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-doctrine-cache","fixed_in":["1.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-doctrine-cache","fixed_in":["1.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-doctrine-cache","fixed_in":["1.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-doctrine-common","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-doctrine-common","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"php-ZendFramework","fixed_in":["1.12.16-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"php-ZendFramework2","fixed_in":["2.4.8-1.mga5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.11.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-stable"},{"fixed":"2.5.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/mongodb-odm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/mongodb-odm-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"aws/aws-sdk-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zfcampus/zf-apigility-doctrine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.10"},{"fixed":"1.12.10-p1+tuxcare"}]}],"versions":["1.12.10"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.0-p2+tuxcare"}]}],"versions":["1.11.0","1.11.0-p1+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.6"},{"fixed":"1.10.6-p2+tuxcare"}]}],"versions":["1.10.6","1.10.6-p1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"doctrine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"doctrine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"doctrine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-doctrine-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-doctrine-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-doctrine-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-doctrine-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-doctrine-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-doctrine-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-doctrine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-doctrine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-1.1+deb7u4"}]}],"versions":["1.11.13-1.1","1.11.13-1.1+deb7u1","1.11.13-1.1+deb7u2","1.11.13-1.1+deb7u3"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9+dfsg-2+deb8u4"}]}],"versions":["1.12.9+dfsg-2","1.12.9+dfsg-2+deb8u1","1.12.9+dfsg-2+deb8u2","1.12.9+dfsg-2+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.11.13"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.11"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.0rc1","2.2.0rc2","2.2.0rc3","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0rc1","2.4.0rc2","2.4.0rc3","2.4.0rc4","2.4.0rc5","2.4.0rc6","2.4.0rc7","2.4.1","2.4.10","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}],"versions":["v1.0","v1.1","v1.1.1","v1.1.2","v1.2.0","v1.2.1","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.2"}]}],"versions":["v1.4.0","v1.4.1"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}],"versions":["2.1.3","2.1.4","2.2.0","2.2.0-RC1","2.2.0-RC3","2.2.0-RC4","2.2.0-RC5","2.2.0BETA1","2.2.0BETA2","2.2.1","2.2.2","2.2.3","2.3.0","2.3.0-BETA1","2.3.0-RC1","2.3.0-RC2","2.3.0-RC3","2.4.0-RC1","2.4.0-RC2","2.4.0-RC3","2.4.0-RC4","v2.4.0","v2.4.1","v2.4.2"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-stable"},{"fixed":"2.5.1"}]}],"versions":["v2.5.0","v2.5.0-beta1"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.1"}]}],"versions":["v2.5.0"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/mongodb-odm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"versions":["1.0.0","1.0.0-BETA10","1.0.0-BETA11","1.0.0-BETA12","1.0.0-BETA13","1.0.0-BETA4","1.0.0-BETA5","1.0.0-BETA6","1.0.0-BETA7","1.0.0-BETA8","1.0.0-BETA9","1.0.1"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/mongodb-odm-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["v2.0.1","v2.1.0","v2.2.0","v2.2.1","v3.0.0","v3.0.0-BETA1","v3.0.0-BETA2","v3.0.0-BETA3","v3.0.0-BETA4","v3.0.0-BETA5","v3.0.0-BETA6"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.3"}]}],"versions":["2.5.0","2.5.1","2.5.2"]},{"source":"osv","ecosystem":"Packagist","package":"aws/aws-sdk-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.1.0","3.2.0"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.2"}]}],"versions":["v1.1","v1.2.0","v1.3.0","v1.3.1"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"]},{"source":"osv","ecosystem":"Packagist","package":"zfcampus/zf-apigility-doctrine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.3"}]}],"versions":["1.0.0","1.0.1","1.0.2"]},{"source":"osv","ecosystem":"Mageia:5","package":"php-ZendFramework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.16-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"php-ZendFramework2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1.mga5"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"doctrine-project","product":"annotations"},{"vendor":"doctrine-project","product":"cache"},{"vendor":"doctrine-project","product":"common"},{"vendor":"doctrine-project","product":"doctrinemongodbbundle"},{"vendor":"doctrine-project","product":"mongodb-odm"},{"vendor":"doctrine-project","product":"object_relational_mapper"},{"vendor":"zend","product":"zend-cache"},{"vendor":"zend","product":"zend_framework"},{"vendor":"zend","product":"zf-apigility-doctrine"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3369","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://framework.zend.com/security/advisory/ZF2015-07","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-01.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20210620092354/https://framework.zend.com/security/advisory/ZF2012-01","tags":["web"]},{"url":"https://github.com/advisories/GHSA-229x-22xc-2f2w"},{"url":"https://framework.zend.com/security/advisory/ZF2014-04","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-04.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2x36-qhx3-7m5f"},{"url":"https://framework.zend.com/security/advisory/ZF2014-02","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-02.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9v78-h226-2rmq"},{"url":"https://github.com/zendframework/zendframework/commit/7c1e89815f5a9c016f4b8088e59b07cb2bf99dc0","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2016-04.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20201107093523/https://framework.zend.com/security/advisory/ZF2016-04","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gff2-p6vm-3p8g"},{"url":"https://framework.zend.com/security/advisory/ZF2014-01","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-01.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mhpx-3rv8-wrjm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5723","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67/"},{"url":"https://github.com/aws/aws-sdk-php/releases/tag/3.2.1","tags":["web"]},{"url":"https://framework.zend.com/security/advisory/ZF2015-07","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml","tags":["web"]},{"url":"https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pw5c-xqf2-6xc2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5723","tags":["advisory"]},{"url":"https://github.com/zendframework/zf1","tags":["package"]},{"url":"https://github.com/zendframework/zendframework","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0391.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16828","tags":["report"]},{"url":"http://framework.zend.com/security/advisory/ZF2015-08","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-September/167698.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5723","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5723","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5723","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2024-08-06T06:59:04.234Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2022-4834","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2024-08-06T06:59:04Z","updated_at":"2026-11-03T02:21:58.196951Z"}],"ghsa":[{"id":"GHSA-229x-22xc-2f2w","title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","description":"Zend_XmlRpc is vulnerable to XML eXternal Entity (XXE) Injection attacks. The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n\n","status":"published","published":"2024-06-07T21:39:43Z","modified":"2024-06-07T21:39:44Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:53.703286Z"},{"id":"GHSA-2x36-qhx3-7m5f","title":"ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select","description":"The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.\n\nFor instance, the following code is affected by this issue:\n```\n$db     = Zend_Db::factory( /* options here */ );\n$select = $db-\u003eselect()\n    -\u003efrom(array('p' =\u003e 'products'))\n    -\u003eorder('MD5(1); drop table products');\necho $select;\n```\nThis code produce the string:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY MD5(1);drop table products ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY \"MD5(1);drop table products\" ASC\n```\nThe SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.","status":"published","published":"2024-06-07T22:24:52Z","modified":"2024-06-07T22:24:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-9v78-h226-2rmq","title":"Zendframework potential security issue in login mechanism","description":"Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.\n\nMoreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.","status":"published","published":"2024-06-07T22:24:08Z","modified":"2024-06-07T22:24:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:54.624184Z"},{"id":"GHSA-gff2-p6vm-3p8g","title":"ZendFramework potential remote code execution in zend-mail via Sendmail adapter","description":"When using the zend-mail component to send email via the `Zend\\Mail\\Transport\\Sendmail transport`, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.\n\n","status":"published","published":"2024-06-07T20:47:30Z","modified":"2024-06-07T20:47:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:53.703286Z"},{"id":"GHSA-mhpx-3rv8-wrjm","title":"ZendFramework potential XML eXternal Entity injection vectors","description":"Numerous components utilizing PHP's `DOMDocument`, `SimpleXML`, and `xml_parse` functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.\n","status":"published","published":"2024-06-07T21:16:36Z","modified":"2024-06-07T21:16:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611","CWE-776"],"updated_at":"2026-11-02T14:37:53.703286Z"},{"id":"GHSA-pw5c-xqf2-6xc2","title":"Doctrine Security Misconfiguration Vulnerability","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2022-05-17T03:44:28Z","modified":"2024-02-05T10:27:56Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:35.293818Z"}],"nvd":[{"id":"CVE-2015-5723","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2016-06-07T14:06:08.697Z","modified":"2026-06-17T00:29:39.55Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-5723","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2016-06-07T14:06:08Z","modified":"2026-04-16T06:23:58.008730385Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5723","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2016-06-07T14:06:08.697Z","modified":"2026-09-09T07:01:31.400095513Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-229x-22xc-2f2w","title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","description":"Zend_XmlRpc is vulnerable to XML eXternal Entity (XXE) Injection attacks. The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n\n","status":"published","published":"2024-06-07T21:39:43Z","modified":"2024-06-07T21:39:43Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"GHSA-2x36-qhx3-7m5f","title":"ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select","description":"The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.\n\nFor instance, the following code is affected by this issue:\n```\n$db     = Zend_Db::factory( /* options here */ );\n$select = $db-\u003eselect()\n    -\u003efrom(array('p' =\u003e 'products'))\n    -\u003eorder('MD5(1); drop table products');\necho $select;\n```\nThis code produce the string:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY MD5(1);drop table products ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY \"MD5(1);drop table products\" ASC\n```\nThe SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.","status":"published","published":"2024-06-07T22:24:52Z","modified":"2024-12-04T05:39:35.461646Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"GHSA-9v78-h226-2rmq","title":"Zendframework potential security issue in login mechanism","description":"Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.\n\nMoreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.","status":"published","published":"2024-06-07T22:24:08Z","modified":"2024-12-04T05:30:41.11192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"GHSA-gff2-p6vm-3p8g","title":"ZendFramework potential remote code execution in zend-mail via Sendmail adapter","description":"When using the zend-mail component to send email via the `Zend\\Mail\\Transport\\Sendmail transport`, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.\n\n","status":"published","published":"2024-06-07T20:47:30Z","modified":"2024-12-04T05:39:06.67482Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"GHSA-mhpx-3rv8-wrjm","title":"ZendFramework potential XML eXternal Entity injection vectors","description":"Numerous components utilizing PHP's `DOMDocument`, `SimpleXML`, and `xml_parse` functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.\n","status":"published","published":"2024-06-07T21:16:36Z","modified":"2024-12-04T05:32:07.571126Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611","CWE-776"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"GHSA-pw5c-xqf2-6xc2","title":"Doctrine Security Misconfiguration Vulnerability","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"published","published":"2022-05-17T03:44:28Z","modified":"2024-11-30T05:31:48.365402Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2015-5723","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","status":"withdrawn","published":"2016-06-07T14:06:00Z","modified":"2025-07-16T08:11:38.714278Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"CLSA-2026-1771548781","title":"TuxCare security update for zendframework/zendframework1 (7 CVEs)","description":"TuxCare rebuilt zendframework/zendframework1 to address 7 CVEs. Fixed in 1.12.10-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:04.665174143Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1787038633","title":"TuxCare security update for zendframework/zendframework1 (10 CVEs)","description":"TuxCare rebuilt zendframework/zendframework1 to address 10 CVEs. Fixed in 1.11.0-p2+tuxcare.","status":"published","published":"2026-08-18T07:37:13Z","modified":"2026-10-15T09:48:00.241242105Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787221779","title":"TuxCare security update for zendframework/zendframework1 (1 CVE)","description":"TuxCare rebuilt zendframework/zendframework1 to address 1 CVE. Fixed in 1.10.6-p2+tuxcare.","status":"published","published":"2026-08-20T10:29:39Z","modified":"2026-10-15T09:48:00.335765829Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"DSA-3369-1","title":"zendframework - security update","status":"published","published":"2015-10-06T00:00:00Z","modified":"2026-03-09T01:22:13.583803Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0391","title":"Updated php-ZendFramework/php-ZendFramework2 packages fixe security vulnerabilities","description":"Zend Framework contained several instances where it was using incorrect\npermissions masks, which could lead to local privilege escalation issues\n(CVE-2015-5723).\n\nThe PDO adapters of Zend Framework 1 do not filter null bytes values in\nSQL statements. A PDO adapter can treat null bytes in a query as a string\nterminator, allowing an attacker to add arbitrary SQL following a null\nbyte,  and thus create a SQL injection (ZF2015-08).\n\nNote that the ZF2015-08 issue did not affect Zend Framework 2.\n","status":"published","published":"2015-10-09T18:47:39Z","modified":"2026-04-16T06:25:12.306021136Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}