Two vulnerabilities have been reported in Zend Framework, which can be exploited by malicious people to disclose sensitive information and cause a DoS (Denial of Service).

1) An error exists within the "Zend_XmlRpc", "Zend_Dom", "Zend_Feed", and "Zend_Soap" classes when processing XML data, which can be exploited to e.g. disclose contents of certain local files by sending specially crafted XML data including external entity references.

2) An error exists within the "Zend_XmlRpc", "Zend_Dom", "Zend_Feed", and "Zend_Soap" classes when processing a XML DOCTYPE declaration including XML entity definitions with e.g. recursive references. This can be exploited to cause CPU and memory resource consumption by sending specially crafted XML data including external entity references.

The vulnerabilities is reported in versions prior to 1.11.13 and 1.12.0.

Solution
Update to version 1.11.13 or 1.12.0.

Provided and/or discovered by
1) K. Gudinavicius, SEC Consult. Additional information provided by Pádraic Brady.
2) The vendor credits Pádraic Brady.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Zend:
http://framework.zend.com/security/advisory/ZF2012-01
http://framework.zend.com/security/advisory/ZF2012-02

SEC Consult:
https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt

Deep Links
Links available to Secunia VIM customers