zendframework: SQL injection
| Package(s): | zendframework |
CVE #(s): | CVE-2016-4861
|
| Created: | October 6, 2016 |
Updated: | October 24, 2016 |
| Description: |
From the Debian-LTS advisory:
CVE-2016-4861:
The implementation of ORDER BY and GROUP BY in Zend_Db_Select
remained prone to SQL injection when a combination of SQL
expressions and comments were used. This security patch provides
a comprehensive solution that identifies and removes comments
prior to checking validity of the statement to ensure no SQLi
vectors occur.
|
| Alerts: |
|