Potential CRLF injection attacks in Zend_Mail

http://servuclean.com/2012/02/concrete-floor-maintenance/ Overview :

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

buy Lurasidone from india online Affected Product(s) :

Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1

Vulnerability Details :

CVE ID : CVE-2015-3154

The Zend Framework team thanks the following for identifying the issues and working with us to help protect its users:

Filippo Tessarotto, who reported the issue on Zend\Mail; and
Enrico Zimuel, who provided the initial patch, as well as ongoing review; and
Maks3w, who reported the Zend\Http issue, and who reviewed the patch and proposed improvements; and
Matthew Weier O’Phinney, who reviewed, tested, and finalized the patch.

Solution :

If you are using Zend\Mail or Zend\Http from Zend Framework 2 (either standalone, or within components like Zend\Mvc), or if you are using the Zend_Mail or Zend_Http components from Zend Framework 1, we recommend upgrading immediately.

The patch fixing the issues has been applied in the following versions:

Zend Framework 1.12.12
Zend Framework 2.3.8
Zend Framework 2.4.1

Potential CRLF injection attacks in Zend_Mail

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-7261 : ZYXEL NWA1123ACV3/WAC500/WAX655E/WBE530/USG LITE 60AX COOKIE HOST OS COMMAND INJECTION

CVE-2024-1621 : NT-WARE UNIFLOW ONLINE UP TO 2024.1.0 REGISTRATION VERIFICATION OF SOURCE

CVE-2024-45623 : D-LINK DAP-2310 1.16RC028 ATP BINARY STACK-BASED OVERFLOW