Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 30 Sep 2015 12:55:45 +0200
From: Alessandro Ghedini <>
Subject: CVE Request: zendframework SQL injections


the Zendframework project released the following advisory:

> ZF2015-08: Potential SQL injection vector using null byte for PDO (MsSql, SQLite)

The patch for the MS SQL backend seems to be:

but I couldn't find the fix for the mentioned SQLite backend.

This is somewhat related to CVE-2014-8089, which was about a similar issue
in the sqlsrv backend.

Can CVE(s) be assigned for these issues?


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.