CVE-2016-4861
zendframework - security update
9.8
CRITICAL
CVSS 3.1
EPSS 4.1%
Description
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
How to fix CVE-2016-4861
To remediate CVE-2016-4861, upgrade the affected package to a fixed version below.
- Debian/zendframework—upgrade to 1.12.9+dfsg-2+deb8u7 or later
- —upgrade to 1.11.13-1.1+deb7u5 or later
- —upgrade to 1.12.20 or later
Is CVE-2016-4861 being exploited?
Low — EPSS is 4.1%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 1.12.9+dfsg-2+deb8u7
- from 0, < 1.11.13-1.1+deb7u5
- from 0, < 1.12.20
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |