Launchpad CVE tracker

CVE 2015-3154

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Related bugs and status

CVE-2015-3154 (Candidate) is related to these bugs:

Bug #1593024: Unblacklist and sync zendframework 1.12.18+dfsg-1 (universe) from Debian unstable (main), delete src:zend-framework from 17.04

		In	Importance	Status
1593024	Unblacklist and sync zendframework 1.12.18+dfsg-1 (universe) from Debian unstable (main), delete src:zend-framework from 17.04	zend-framework (Ubuntu)	Wishlist	Fix Released
1593024	Unblacklist and sync zendframework 1.12.18+dfsg-1 (universe) from Debian unstable (main), delete src:zend-framework from 17.04	icingaweb2 (Ubuntu)	Wishlist	Fix Released
1593024	Unblacklist and sync zendframework 1.12.18+dfsg-1 (universe) from Debian unstable (main), delete src:zend-framework from 17.04	zendframework (Ubuntu)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2015-3154

References