Fluid Attacks Database

Description

Zend Framework Information Disclosure Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	zendframework/zendframework	>=2.5.0 <2.5.2 \|\| >=2.0.0 <2.4.9	2.5.2, 2.4.9
packagist	zendframework/zend-crypt	>=2.0.0 <2.4.9 \|\| >=2.5.0 <2.5.2	2.4.9, 2.5.2

Aliases

1. CVE-2015-75032. NVD-2015-75033. OSV-2015-75034. GCVE-2015-7503

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=12831372. https://framework.zend.com/security/advisory/ZF2015-103. https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-crypt/CVE-2015-7503.yaml4. https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-7503.yaml