Free Trial

Potential CRLF injection attacks in Zend_Mail

Overview :
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Affected Product(s) :
  • Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1
Vulnerability Details :
CVE ID : CVE-2015-3154
The Zend Framework team thanks the following for identifying the issues and working with us to help protect its users:

  • Filippo Tessarotto, who reported the issue on Zend\Mail; and
  • Enrico Zimuel, who provided the initial patch, as well as ongoing review; and
  • Maks3w, who reported the Zend\Http issue, and who reviewed the patch and proposed improvements; and
  • Matthew Weier O’Phinney, who reviewed, tested, and finalized the patch.

Solution :

If you are using Zend\Mail or Zend\Http from Zend Framework 2 (either standalone, or within components like Zend\Mvc), or if you are using the Zend_Mail or Zend_Http components from Zend Framework 1, we recommend upgrading immediately.

The patch fixing the issues has been applied in the following versions:

  • Zend Framework 1.12.12
  • Zend Framework 2.3.8
  • Zend Framework 2.4.1

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-44400 : ORETNOM23 PURCHASE ORDER MANAGEMENT SYSTEM 1.0 UNRESTRICTED UPLOAD

CVE-2022-44400 : ORETNOM23 PURCHASE ORDER MANAGEMENT SYSTEM 1.0 UNRESTRICTED UPLOAD

Description Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info. References https://github.com/lcg-22266/bug_report/blob/main/vendors/oretnom23/Purchase%20Order%20Management%20System/UPLOAD-1.md For More Information MITRE

Learn more
CVE-2022-45919 : LINUX KERNEL UP TO 6.0.10/0221.C DVB_CA_EN50221.C DVB_CA_EN50221_IO_RELEASE USE AFTER FREE

CVE-2022-45919 : LINUX KERNEL UP TO 6.0.10/0221.C DVB_CA_EN50221.C DVB_CA_EN50221_IO_RELEASE USE AFTER FREE

Description An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is

Learn more
CVE-2022-41157 : KYUNGRINARA ERP SOLUTION SERP SERVER HARD-CODED CREDENTIALS

CVE-2022-41157 : KYUNGRINARA ERP SOLUTION SERP SERVER HARD-CODED CREDENTIALS

Description A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This

Learn more