Overview :
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Affected Product(s) :
  • Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1
Vulnerability Details :
CVE ID :CVE-2015-3154
The Zend Framework team thanks the following for identifying the issues and working with us to help protect its users:

Solution :

If you are using Zend\Mail or Zend\Http from Zend Framework 2 (either standalone, or within components like Zend\Mvc), or if you are using the Zend_Mail or Zend_Http components from Zend Framework 1, we recommend upgrading immediately.

The patch fixing the issues has been applied in the following versions:

  • Zend Framework 1.12.12
  • Zend Framework 2.3.8
  • Zend Framework 2.4.1